Do not attempt to implement any of the settings in this guide without first testing in a non-operational environment. This document is only a guide containing recommended security configurations. It is not meant to replace well-structured policy or sound judgment. Furthermore, this guide does not address site-specific configuration issues. Care must be taken when implementing this guide while using products such as Microsoft Exchange, IIS, and SMS. The security changes described in this document only apply to Microsoft Windows 2000 Service Pack 1 systems and should not be applied to any other Windows versions or operating systems. You can severely impair or disable a Windows 2000 system with incorrect changes or accidental deletions when using programs (examples: Security Configuration Tool Set, Regedt32.exe, and Regedit.exe) to change the system configuration. Therefore, it is extremely important to test all settings recommended in this guide before installing them on an operational network. Currently, no Undo function exists for deletions made within the Windows 2000 registry. The registry editor (Regedt32.exe or Regedit.exe) prompts you to confirm the deletions if Confirm On Delete is selected from the options menu. When you delete a registry key, the message does not include the name of the key you are deleting. Therefore, check your selection carefully before proceeding with any deletion.

In order for Active Directory to properly use DNS, Active Directory requires DNS Service Resource Record (SRV RR) support and BIND 8.1.2 or higher.

The Microsoft Management Console is used to customize and apply some of the security settings to Windows systems. A Registry editor (Regedt32.exe or Regedit.exe) can be used for manipulation of registry keys.

v1.0, 2000-12