CalNetAD Configuration Files

Updated: 03/10/2004

Security Configuration Editor (SCE)

• UCB Security Configuration Template for the SCE is a UCB specific extension of the NSA and Microsoft SCERegVl.INF files. This template is required on the local machine to access UCB specific changes with the SCE.

Domains

• UCB DDNS administrative template to disable Dynamic DNS on domain computers. Campus DNS does not support host Dynamic DNS. This administrative template reduces network traffic and host and server overhead caused by rejected Dynamic DNS connection attempts.

• UCB Domain security template

Domain Controllers

• UCB DDNS administrative template to modify Domain Controller registry Dynamic DNS settings. Campus DNS supports Dynamic DNS with Domain Controllers. IPsec policy for traffic between Domain Controller and Campus DNS should be inplace before applying this template.

• UCB Domain Controller security template

• Domain Controller Bounds registry modification

• LMHOSTS file

• AD Replication RPC Ports template sets a fixed RPC replication port. Useful for firewalls and IDS software to secure replication traffic.

• LDAP Query Logging template enables verbose logging of LDAP queries and allows modification of expensive LDAP search query threshold. Useful for auditing LDAP queries issued against Active Directory.

Member Servers

• UCB Member Server security template

Workstations

• UCB Workstation security template

• Outlook 10 security template configures Outlook 10 to display un-signed e-mail as plain-text instead of html.

Services Templates

• Disable RAS Counters template disables RAS PerfMon counters

• Internet Explorer UCB template controls IE Integrated Authentication support

• RPC Ports Registry file sets the dynamic RPC ports to a limited range. Useful for firewalls and IDS software to secure RPC connections. Settings are included in ucb_sceregvl_2.0.inf.

• RoboMon template sets the HeroixRoboMon agent e-mail settings.

  UCB Dfs Server administrative template configures the Dfs server to Use Fully Qualified Domain Names in referrals, instead of NetBIOS name. Recommended for all non-WINS environments.

• UCB Eventlog administrative template moves the location of the Eventlog log files.

• UCB Internet Services Disable security template disables common Internet services. Some services should not be enabled, until properly configured.

Tools/Instructions

• Implementing Registry-Based Group Policy for Applications - The appendix to this white paper contains a full language reference to the .adm language used to deploy registry based policies.
• Windows Update Configuration