Security Settings

With Security Settings, you can modify the security policy of an organizational unit, domain, or site, from any one computer that is joined to a domain.

Security Settings allows a security administrator to modify security settings assigned to a Group Policy object. If you would like to modify the security settings on your local computer go to Local Security Policy.
  • Before changing security settings, see Checklist: Securing computers using Security Configuration Manager.
  • Before changing security settings, see Best Practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.
  • Other security policy tools:
Security Configuration Manager | Description
Security Templates | You can define a security policy in a template. These templates can be applied to a Group Policy object or to your local computer security.
Security Configuration and Analysis | You can use this tool to configure your computer using a security template or to compare your current computer settings to the settings defined in a security template.
Local Security Policy | You can use this tool to edit individual security settings on your local computer.
Secedit | You can use this tool to automate security configuration tasks


Best practices for Security Settings

Be cautious when creating new policies

  • Always test a newly-created policy on a test computer before applying it to your network.

Be aware that more than one policy can be applied to a computer

  • Because of this, there can be conflicts in security policy settings. The order of precedence from highest precedence to lowest precedence is:
    1. Organizational unit
    2. Domain
    3. Local computer
    For more information, see Applying security policy.
  • You can use Resultant Set of Policy to find out what policies apply to a certain computer. For more information , see Resultant set of policy.

Keep in mind that there can only be one account policy in a domain: the Default Domain Policy

For more information, see Account and local policies.

Apply templates appropriately

  • Do not apply the Compatible template to Domain Controller computers. For example, do not import the Compatible template to Default Domain Policy or Default Domain Controller Policy.
  • Do not apply the Setup security template through Group Policy.

Use the correct tools for configuring local policy

  • For local security policy, use the Local Security Policy shortcut for editing and fine-tuning security policy. Use Security Templates to create a local policy and then use Security Configuration and Analysis to apply the policy.


How to...

  • Edit a security setting on a Group Policy object
  • Import a security template to a Group Policy object
  • Permit users to log on locally to a domain controller


Edit a security setting on a Group Policy object

Microsoft Windows graphic

To edit a security setting on a Group Policy object

Choose the appropriate environment for which you want to edit a security setting:

For your local computer

  1. Open Local Security Settings.
  2. In the console tree, click Security Settings.
  3. Do one of the following:
    • To edit Password Policy or Account Lockout Policy, click Account Policies.
    • To edit an Audit Policy, a User Right Assignment, or Security Options, click Local Policies.
  4. Double-click the security setting in the details pane that you want to modify.
  5. Modify the security setting, and then click OK.

Notes

  • XOX
  • XOX

For a Group Policy object, when you are on a workstation or server that is joined to a domain.

  1. On the taskbar, click Start, point to Run, type mmc, and then click OK.
  2. In the console, on the File menu, click Add/Remove snap-in.
  3. In Add/Remove Snap-in, click Add, and then, in Add Standalone Snap-in, double-click Group Policy Object Editor.
  4. In Select Group Policy Object, click Browse, browse to the policy object you would like to modify, and then click Finish.
  5. Click Close, and then click OK.
  6. In the console tree, click Security Settings.

    7. Where?

    • GroupPolicyObject [ComputerName] Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
  7. Do one of the following:
    • To edit Password Policy, Account Lockout Policy, or Kerberos Policy, in the details pane, double-click Account Policies.
    • To edit Audit Policy, User Rights Assignment, or Security Options, in the details pane, double-click Local Policies.
    • To edit event log settings, on the console tree, click Event Log.
  8. In the details pane, double-click the security setting that you want to modify.
  9. (Optional) If this security setting has not yet been defined, select the Define these policy settings check box.
  10. Modify the security setting and then click OK.

Note

  • XOX

For a Group Policy object, when you are on a domain controller or on a workstation that has the Windows Server 2003 Administration Tools Pack installed.

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the Group Policy object for which you want to edit security settings.
  3. Click Properties, and then click the Group Policy tab.
  4. Do one of the following:
    • To edit an existing Group Policy object, click Edit.
    • To create a new Group Policy object, click New, and then click Edit.
  5. In the console tree, click Security Settings.

    6. Where?

    • GroupPolicyObject [ComputerName] Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
  6. Do one of the following:
    • To edit Password Policy, Account Lockout Policy, or Kerberos Policy, click Account Policies.
    • To edit Audit Policy, User Rights Assignment, or Security Options, click Local Policies.
    • To edit Event log settings, click Event Log.
  7. Double-click the security setting in the details pane that you want to modify.
  8. (Optional) If this security setting has not yet been defined, select the Define these policy settings check box.
  9. Modify the security setting and then click OK.

Notes

  • XOX
  • XOX

For only domain controllers, when you are on a domain controller.

  1. Open Domain Controller Security Policy.
  2. In the console tree, click Security Settings.

    3. Where?

    • GroupPolicyObject [ComputerName] Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
  3. Do one of the following:
    • To edit Password Policy, Account Lockout Policy, or Kerberos Policy, in the console tree, double-click Account Policies.
    • To edit Audit Policy, User Rights Assignment, or Security Options, in the console tree, click Local Policies.
    • To edit event log settings, in the console tree, click Event Log.
  4. In the details pane, double-click the security setting that you want to modify.
  5. (Optional) If this security setting has not yet been defined, select the Define these policy settings check box.
  6. Modify the security setting, and then click OK.

Notes

  • XOX
  • XOX

Notes

  • Always test a newly-created policy on a test organizational unit before applying it to your network.
  • When you change a security setting and click OK, that setting will take effect in the next refresh of settings.
  • XOX

Related Topics


Concepts

This section provides general information on configuring the security areas in Security Settings:

  • Security Settings overview
  • Understanding Security Settings
  • Security Setting Descriptions


Security Settings overview

Organizational units, domains, and sites are linked to Group Policy objects. The Security Settings tool allows you change the security configuration of the Group Policy object, in turn, affecting multiple computers. With Security Settings, you can modify the security settings of many computers, depending on the Group Policy object you modify, from just one computer joined to a domain.

Security settings or security policies are rules that are configured on a computer or multiple computers for protecting resources on a computer or network. Security settings can control:

  • How users are authenticated to a network or computer.
  • What resources users are authorized to use.
  • Whether or not a user's or group's actions are recorded in the event log.
  • Group membership.

For more information, see Security setting descriptions.

Using Security Settings

You can change the security configuration on multiple computers in two ways:

  • Create a security policy using a security template with Security Templates and then import it through Security Settings to a Group Policy object. For more information, see To import a security template to a Group Policy object.
  • Change a few select settings with Security Settings. For more information, see To edit a security setting on a Group Policy object.


Understanding Security Settings

  • Applying security settings through Group Policy
  • Account and local policies
  • Event log security settings
  • Security settings for file system, registry, system services


Applying security settings through Group Policy

When policy is applied

Once you have edited the security settings, the settings are refreshed on the computers in the organizational unit linked to your Group Policy object:
  • When a computer is restarted the settings on that computer will be refreshed.
  • XOX
  • To force a computer to refresh its security settings as well as all Group Policy settings, see the gpupdate command line tool.

Precedence of policy when more than one policy is applied to a computer

For security settings which are defined by more than one policy, the following order of precedence, from highest to lowest, is observed:

  • Organizational Unit Policy
  • Domain Policy
  • Site Policy
  • Local computer Policy

For example, a workstation that is joined to a domain will have its local security settings overridden by the domain policy wherever there is a conflict. Likewise, if the same workstation is a member of an Organizational Unit, the settings applied from the Organizational Unit's policy will override both the domain and local settings. If the workstation is a member of more than one Organizational Unit, then the Organizational Unit that immediately contains the workstation has the highest order of precedence.

Notes

  • Use Resultant Set of Policies tool to find out what policies are applied and in what order to a computer. For more information , see Resultant set of policy.
  • For domain accounts, there can be only one account policy which includes password policies, account lockout policies, and kerberos policies. For more information, see Account and local policies.

Persistence in security settings

Security settings may still persist even if a setting is no longer defined in the policy that originally applied it.

Persistence in security settings occurs when:

  • The setting has not been previously defined for the computer.
  • The setting is for a registry object.
  • The settings is for a file system object.

All settings applied through local policy or a Group Policy object are stored in a local database on your computer. Whenever a security settings is modified, the computer saves the security setting value to the local database which retains a history of all the settings that have been applied to the computer. If a policy first defines a security setting and then no longer defines that setting, then the setting takes on the previous value in the database. If a previous value does not exist in the database then the setting does not revert to anything and remains defined as is. This behavior is sometimes called "tattooing."

Registry and file settings will maintain the values applied through policy until that setting is set to other values.

Filtering security settings based on group membership

You can also decide what users or groups will or will not have a Group Policy object applied to them regardless of what computer they have logged onto by denying them either the Apply Group Policy or Read permission on that Group Policy object. Both of these permissions are needed to apply Group Policy. For more information, see Group Policy.


Concepts

This section provides general information on configuring security using Security Settings:

  • Security Settings overview
  • Applying Security Settings
  • Understanding Security Settings