Security Configuration and Analysis

You can use Security Configuration and Analysis to analyze and configure local computer security.

  • Before proceeding, see Checklist: Securing your computers using Security Configuration Manager.
  • For help with specific tasks, see How To.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.
  • Other security policy tools:
Security Configuration Manager tool | Description
Security Templates | Defines a security policy in a template. These templates can be applied to Group Policy or to your local computer.
Security Settings extension to Group Policy | Edits individual security settings on a domain, site, or organizational unit.
Local Security Policy | Edits individual security settings on your local computer.
Secedit | Automates security configuration tasks at a command prompt.

For more information on the individual security settings, see Security settings descriptions.


Best practices for Security Configuration and Analysis

Security Configuration and Analysis is a tool which can be used to analyze and configure computer security. For general security issues, see Best practices for security.

If you require frequent analysis of a large number of computers, as with a domain-based infrastructure, use the Secedit.exe command line tool.

For more information, see Automating security configuration tasks.

Only use Security Configuration and Analysis to configure security areas not affected by Group Policy settings.

This includes areas such as security on local files and folders, registry keys, and system services. Otherwise, Group Policy settings will override the local settings. For more information, see Group Policy.

Do not use Security Configuration and Analysis when you are configuring security for a domain or an organizational unit.

Otherwise, you must configure each client individually. In that case, you can:

  • Use Security Templates to create a template and apply it to the appropriate Group Policy object.
    • For more information, see To import a security template to a Group Policy object.
  • Use the Security Settings extension to Group Policy to edit individual security settings on a Group Policy object. For more information, see To edit a security setting on a Group Policy object.


How to...

  • Add Security Configuration and Analysis to an MMC console
  • Analyze system security
  • Configure local system security
  • Reapply default security settings
  • Import a security template
  • Export a security template
  • Edit the analysis database


Add Security Configuration and Analysis to an MMC console

Microsoft Windows graphic

To add Security Configuration and Analysis to an MMC console

  1. Click Start, click Run, type mmc, and then click OK.
  2. Do one of the following:
    • To create a new console, on the File menu, click New.
    • To open an existing console, on the File menu, click Open, click the console that you want to open, and then click Open.
  3. On the File menu, click Add/Remove Snap-in, and then, in Add/Remove Snap-in, click Add.
  4. Click Security Configuration and Analysis, click Add, click Close, and then click OK.

Notes

  • XOX
  • For more information, see Working with MMC console files.

Related Topics


Analyze system security

Microsoft Windows graphic

To analyze system security

Using the Windows interface

  1. Open Security Configuration and Analysis.
  2. In the console tree, right-click Security Configuration and Analysis, and then click Open Database.

    Where?

    • ConsoleRoot
    • Security Configuration and Analysis
  3. In Open database, do one of the following:
    • To create a new database, in File name, type a file name, and then click Open.
    • To open an existing database, click a database, and then click Open.
  4. If you are creating a new database, in Import Template, click a template, and then click Open.
  5. In the details pane, right-click Security Configuration and Analysis, and then click Analyze Computer Now.
  6. Do one of the following:
    • To use the default log, in Error log file path, click OK.
    • To specify a different log, in Error log file path, type a valid path and file name, and then click OK.

Notes

  • XOX
  • To open Security Configuration and Analysis, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Security Configuration and Analysis.
  • Security Configuration and Analysis displays the different security areas as they are analyzed. Once this is complete, you can check the log file or review the results. For more information on reviewing the analysis results, see Related Topics.
  • To view the log file, in the console tree, right-click Security Configuration and Analysis, and then click View Log File.
  • The default path for the log file is:

    systemroot\Documents and Settings\UserAccount\My Documents\Security\Logs\DatabaseName.log

Using a command line

  1. Open Command Prompt.
  2. Type:

    secedit /analyze /db FileName.sdb [/cfg FileName] [/overwrite] [/log FileName] [/quiet]

    Argument | Description
    /db FileName | Specifies the database used to perform the analysis.
    /cfg FileName | Specifies a security template to import into the database prior to performing the analysis. Security templates are created using the Security Templates snap-in.
    /log FileName | Specifies a file in which to log the status of the configuration process. If not specified, configuration data is logged in Scesrv.log, which is located in the %windir%\Security\Logs folder.
    /quiet | Specifies that the analysis process should take place without further comments.

    Example: secedit /analyze /db hisecws.sdb

Notes

  • XOX
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    secedit /?

Related Topics


Configure local computer security

Microsoft Windows graphic

To configure local computer security

Using the Windows interface

  1. Open Security Configuration and Analysis.
  2. In the console tree, right-click Security Configuration and Analysis, and then click Open Database.

    Where?

    • ConsoleRoot
    • Security Configuration and Analysis
  3. In Open database, do one of the following:
    • To create a new database, in File name, type a file name, and then click Open.
    • To open an existing database, click a database, and then click Open.
  4. If you are creating a new database, in Import Template, click a template, and then click Open.
  5. In the console tree, right-click Security Configuration and Analysis, and then click Configure Computer Now.
  6. Do one of the following:
    • To use the default log in Error log file path, click OK.
    • To specify a different log, in Error log file path, type a valid path and file name.

Notes

  • XOX
  • To open Security Configuration and Analysis, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. In the console tree, click Security Configuration and Analysis.
  • To check the log file, right-click Security Configuration and Analysis, and then click View Log File.
  • The default path for the log file is:

    systemroot\Documents and Settings\UserAccount\My Documents\Security\Logs\

Using a command line

  1. Open Command Prompt.
  2. Type:

    secedit/configure /DB FileName [/CFG FileName][/overwrite][/areas Area1 Area2...] [/log LogPath] [/quiet]

Argument | Description
/DB FileName | Specifies the database used to perform the security configuration.
/CFG FileName | Specifies a security template to import into the database prior to configuring the computer. Security templates are created using the Security Templates snap-in.
/overwrite | Specifies that the database should be emptied prior to importing the security template. If this parameter is not specified, the settings in the security template are accumulated in the database. If this parameter is not specified and there are conflicting settings in the database and the template that is being imported, the template settings take precedence.
/areas Area1 Area2... Specifies the security areas to be applied to the system. If this parameter is not specified, all security settings that are defined in the database are applied to the system. To configure multiple areas, separate each area by a space. The following security areas are supported:
Area name | Description
SECURITYPOLICY | Includes account policies, audit policies, event log settings, and security options.
GROUP_MGMT | Includes Restricted Group settings.
USER_RIGHTS | Includes user rights assignment.
REGKEYS | Includes registry permissions.
FILESTORE | Includes file system permissions.
SERVICES | Includes system service settings.
/log LogPath | Specifies a file in which to log the status of the configuration process. If not specified, configuration data is logged in the scesrv.log file, which is located in the %windir%\Security\Logs folder.
/quiet | Specifies that the configuration process should take place without prompting the user.

Examples:

  • secedit /configure /db hisecws.sdb /cfg
  • hisecws.inf /overwrite /log hisecws.log

Notes

  • XOX
  • XOX
  • The default path for the log file is:

    %windir%\Security\Logs\Scesrv.log

  • Secedit /refreshpolicy has been replaced with gpupdate. For information on how to refresh security settings, see Gpupdate.
  • To view the complete syntax for this command, at a command prompt, type:

    secedit /?

Related Topics


Reapply default security settings

Microsoft Windows graphic

To reapply default security settings

Using the Windows interface

  1. Open Security Configuration and Analysis.
  2. In the console tree, right-click Security Configuration and Analysis, and then click Open Database.

    Where?

    • ConsoleRoot
    • Security Configuration and Analysis
  3. In File name, type the file name, and then click Open.
  4. Do one of the following:
    • For a domain controller, in the console tree, right-click Security Configuration and Analysis, click Import Template, and then click DC security.
    • For other computers, in the console tree, right-click Security Configuration and Analysis, click Import Template, and then click setup security.
  5. Select the Clear this database before importing check box, and then click Open.
  6. In the console tree, right-click Security Configuration and Analysis, and then click Configure Computer Now.
  7. Do one of the following:
    • To use the default log specified in Error log file path, click OK.
    • To specify a different log, in Error log file path, type a valid path and file name, and then click OK.
  8. When the configuration is done, right-click Security Configuration and Analysis, and then click View Log File.

Important

  • Applying the entire setup security template is a drastic measure that should be avoided. Instead, use the secedit command-line tool to apply default settings for specific areas. See the Using a command line section of this procedure.

Notes

  • Different permissions are required to perform this procedure, depending on the environment in which you reapply default security settings:
    • If you reapply default security settings to your local computer: XOX
    • If you reapply default security settings to a computer that is joined to a domain: XOX
  • To open Security Configuration and Analysis, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. In the console tree, click Security Configuration and Analysis.
  • The default path for the log file is:

    systemroot\Documents and Settings\UserAccount\My Documents\Security\Logs\

  • When you reapply default security settings, all settings that are defined in Setup security.inf are set as the template specifies, but other settings that are not defined in the template may persist. For more information, see Persistence in security settings.

Using a command line

  • Open Command Prompt.
  • For a server or workstation, type:

    secedit /configure /DB FileName /CFG "%windir%\Security\Templates\Setup security.inf" [/overwrite][/areas Area1 Area2...] [/log LogPath] [/quiet]

    For a domain controller, type:

    secedit /configure /DB FileName /CFG "%windir%\Security\Templates\DC security.inf" [/overwrite][/areas Area1 Area2...] [/log LogPath] [/quiet]

Argument | Description
/DB FileName | Required. Provides the path to a database that contains the security template that should be applied. To create a new database, type the database file name and path.
/CFG "%windir%\Security\Templates\Setup security.inf" | Specifies the Setup Security.inf template that contains the default security settings.
/overwrite | Specifies that the database should be emptied prior to importing the security template. If this parameter is not specified, the settings in the security template are accumulated into the database. If this parameter is not specified and there are conflicting settings in the database and the template being imported, the template settings win.
/areas Area1 Area2... Specifies the security areas to be applied to the system. If this parameter is not specified, all security settings defined in the database are applied to the system. To configure multiple areas, separate each area by a space. The following security areas are supported:
Area name | Description
SECURITYPOLICY | Includes account policies, audit policies, event log settings, and security options.
GROUP_MGMT | Includes Restricted Group settings.
USER_RIGHTS | Includes user rights assignment.
REGKEYS | Includes registry permissions.
FILESTORE | Includes file system permissions.
SERVICES | Includes System Service settings.
/log LogPath | Specifies a file in which to log the status of the configuration process. If not specified, configuration data is logged in the Scesrv.log file, which is located in the %windir%\Security\Logs folder.
/quiet | Specifies that the configuration process should take place without prompting the user.

Important

  • It is advisable to apply Setup security in parts using the Areas parameter, so you can have control over which parts you are restoring.

Notes

  • Different permissions are required to perform this procedure, depending on the environment in which you reapply default security settings:
    • If you reapply default security settings to your local computer: XOX
    • If you reapply default security settings to a computer that is joined to a domain: XOX
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    secedit /?

Related Topics


Import a security template

Microsoft Windows graphic

To import a security template

  1. Open Security Configuration and Analysis.
  2. In the console tree, right-click Security Configuration and Analysis, and then click Import Template.

    Where?

    • ConsoleRoot
    • Security Configuration and Analysis
  3. (Optional) To clear the database of any template that has been previously stored, select the Clear this database before importing check box.
  4. Click a template file, and then click Open.
  5. Repeat these steps for each template that you want to merge into the database.

Notes

  • XOX
  • To open Security Configuration and Analysis, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. In the console tree, click Security Configuration and Analysis. If Security Templates is not in the console, for instructions on installing it, see Related Topics.
  • Importing templates to a personal database only affects the analysis database and does not affect your system settings.
  • If you import more than one template, the database will merge the various templates to create one composite template, resolving conflicts in order of import. The last template that is imported takes precedence.

Related Topics


Export a security template

Microsoft Windows graphic

To export a security template

  1. Open Security Configuration and Analysis.
  2. In the console tree, right-click Security Configuration and Analysis, and then click Export Template.

    Where?

    • ConsoleRoot
    • Security Configuration and Analysis
  3. Type a valid file name and a path to the location where your template will be saved.

Notes

  • XOX
  • To open Security Configuration and Analysis, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. In the console tree, click Security Configuration and Analysis. For more information, see Related Topics.

Related Topics


Edit the analysis database

Microsoft Windows graphic

To edit the analysis database

  1. Open Security Configuration and Analysis.
  2. In the console tree, right-click Security Configuration and Analysis, click Analyze Computer Now, and then click OK.

    Where?

    • ConsoleRoot
    • Security Configuration and Analysis
  3. After Security Configuration and Analysis has finished analyzing the computer, in the console tree, click the group of settings that contains the security attribute you want to edit.
  4. In the details pane, double-click the security attribute that you want to edit.
  5. Confirm that the Define this policy in the database check box is selected.
  6. Configure the security attribute setting as you want it to be recorded in the database, and then click OK.
  7. Repeat the last four steps for each security attribute that you want to edit.
  8. When you are finished modifying the database settings, in the console tree, right-click Security Configuration and Analysis, and then click Save.

Notes

  • XOX
  • To open Security Configuration and Analysis, click Start, click Run, type mmc, and then click OK. On the File menu, click Open, click the console that you want to open, and then click Open. Then, in the console tree, click Security Configuration and Analysis.
  • The changes that you make will not affect system security. They will only affect the analysis database.
  • For more information, see Security setting descriptions

Related Topics


Concepts

This section provides general background information about Security Configuration and Analysis:

  • Security Configuration and Analysis overview
  • Using Security Configuration and Analysis
  • Security setting descriptions
  • Resources


Security Configuration and Analysis overview

Security Configuration and Analysis is a tool for analyzing and configuring local system security.

Security analysis

The state of the operating system and applications on a computer is dynamic. For example, you may need to temporarily change security levels so that you can immediately resolve an administration or network issue. However, this change can often go unreversed. This means that a computer may no longer meet the requirements for enterprise security.

Regular analysis enables an administrator to track and ensure an adequate level of security on each computer as part of an enterprise risk management program. An administrator can tune the security levels and, most importantly, detect any security flaws that may occur in the system over time.

Security Configuration and Analysis enables you to quickly review security analysis results. It presents recommendations alongside of current system settings and uses visual flags or remarks to highlight any areas where the current settings do not match the proposed level of security. Security Configuration and Analysis also offers the ability to resolve any discrepancies that analysis reveals.

Security configuration

Security Configuration and Analysis can also be used to directly configure local system security. Through its use of personal databases, you can import security templates that have been created with Security Templates and apply these templates to the local computer. This immediately configures the system security with the levels specified in the template.

For more information, see Security Configuration and Analysis.


Using Security Configuration and Analysis

Security Configuration and Analysis offers the ability to perform database-driven configuration and analysis of security settings on the local computer.

  • Predefined security templates
  • Importing and exporting security templates
  • Analyzing security and viewing results
  • Resolving security discrepancies


Importing and exporting security templates

Security Configuration and Analysis provides the ability to import and export security templates into or from a database.

If you have made any changes to the analysis database, you can save those settings by exporting them into a template. The export feature provides the ability to save the analysis database settings as a new template file. This template file can then be used to analyze or configure a system or it can be imported to a Group Policy object.

For more information, see To import a security template and To export a security template.


Analyzing security and viewing results

Security Configuration and Analysis performs security analysis by comparing the current state of system security against an analysis database. During creation, the analysis database uses at least one security template. If you choose to import more than one security template, the database will merge the various templates and create one composite template. It resolves conflicts in order of import; the last template that is imported takes precedence.

Viewing security analysis results

Security Configuration and Analysis displays the analysis results by security area, using visual flags to indicate problems. It displays the current system and base configuration settings for each security attribute in the security areas. To change the analysis database settings, right-click the entry and click Properties.

Visual flag | Meaning
Red X | The entry is defined in the analysis database and on the system, but the security setting values do not match.
Green check | The entry is defined in the analysis database and on the system and the setting values match.
Question mark | The entry is not defined in the analysis database and, therefore, was not analyzed. If an entry is not analyzed, it may be that it was not defined in the analysis database or that the user who is running the analysis may not have sufficient permission to perform analysis on a specific object or area.
Exclamation point | This item is defined in the analysis database, but does not exist on the actual system. For example, there may be a restricted group that is defined in the analysis database but does not actually exist on the analyzed system.
No highlight | The item is not defined in the analysis database or on the system.

If you choose to accept the current settings, the corresponding value in the base configuration is modified to match them. If you change the system setting to match the base configuration, the change will be reflected when you configure the system with Security Configuration and Analysis.

To avoid continued flagging of settings that you have investigated and determined to be reasonable, you can modify the base configuration. The changes are made to a copy of the template.

For more information, see To analyze system security, Resolving security discrepancies, and Security setting descriptions.


Resolving security discrepancies

You can resolve discrepancies between analysis database and system settings by:

  • Accepting or changing some or all of the values that are flagged or not included in the configuration, if you determine that the local system security levels are valid due to the context (or role) of that computer. These attribute values are then updated in the base and applied to the system when you click Configure Computer Now. For more information, see To edit the analysis database.
  • Configuring the system to the analysis database values, if you determine the system is not in compliance with valid security levels. For more information, see To configure system security.
  • Importing a more appropriate template for the role of that computer into the database as the new base configuration and applying it to the system. For more information, see To import a security template to a database.

Changes to the analysis database are made to the stored template in the database, not to the security template file. The security template file will only be modified if you either return to Security Templates and edit that template or export the stored configuration to the same template file.

You should use Configure Computer Now only to modify security areas not affected by Group Policy settings, such as security on local files and folders, registry keys, and system services. Otherwise, when the Group Policy settings are applied, it will take precedence over local settings—such as account policies. In general, do not use Configure Computer Now when you are analyzing security for domain-based clients, since you will have to configure each client individually. In this case, you should return to Security Templates, modify the template, and reapply it to the appropriate Group Policy object.


Resources

For more information about security, see the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

For more information about authorization and access control, see the Microsoft Windows Resource Kits Web site.(http://www.microsoft.com/)

For more information about authentication, see "Logon and Authentication" at the Microsoft Windows Resource Kits Web site.(http://www.microsoft.com/)

For more information about security groups, see "Designing an Authorization Strategy" at the Microsoft Windows Resource Kits Web site.(http://www.microsoft.com/)

For the latest recommendations on security, see the Microsoft Security page on the Microsoft Web site.(http://www.microsoft.com)

For information about the Microsoft Security Notification Service, see the Product Security Notification page on the Microsoft Web site. (http://www.microsoft.com/)