Dangerous Services, Part 3

In Part 1 and Part 2 of this article, I described several services in Windows 2000 that open potential doors to attackers or present Denial of Service (DoS) targets. Here, in Part 3, I'll show you how to use Group Policy to centrally control services on all the computers in your domain. I'll also share some tips about Group Policy security settings that you might want to use to keep your systems secure from network attacks.

You can use a Group Policy Object (GPO) to set the startup mode and ACL for services by defining settings in Computer Configuration, Windows Settings, Security Settings, System Services, as Figure 1 shows. You can configure a service to start automatically with each system boot, or you can set a service to manual startup mode, which waits for the administrator to start the service from the Microsoft Management Console (MMC) Services snap-in. Win2K also starts a service configured for manual startup if another service that depends on it starts. You can view the dependencies for each service in the Services snap-in by double-clicking the service and selecting the Dependencies tab. However, if you disable a service that you decide might be a security risk, Win2K lets you start the service only if you first switch to manual or automatic startup mode. . . .