Audit Policy Settings; User Rights Assignments - HP StorageWorks X5000 Technical Manual

2.9.1

Audit Policy Settings

The Audit Policy settings for file servers in the three environments defined in this guide are configured
via the MSBP. For more information on the MSBP, see section 2.8. The MSBP settings ensure that all
the relevant security audit information is logged on all file servers.
2.9.2

2.9.2 User Rights Assignments

Most User Rights Assignments for file servers in the three environments defined in this guide are
configured via the MSBP. For more information on the MSBP, see section 2.8. Differences between
the MSBP and the Incremental file server Group Policy are described in the following section.
Member Server Default
SUPPORT_388945a0
Important: For all HP NAS server systems, administrators should only deny the Support_388945a0
account within multi-protocol environments involving NFS, AFTP, NCP, HTTP, or FTP.
Note: ANONOYMOUS LOGON, Built-in Administrator, Support_388945a0, Guest, and all NON-
operating system service accounts are not included in the security template. These accounts and
groups have unique security identifiers (SIDs) for each domain on the network. Therefore, they must be
added manually.
The Deny access to this computer from the network setting determines which users are prevented from
accessing a computer over the network. This setting will deny a number of network protocols,
including server message block (SMB)-based protocols, network basic input/output system (NetBIOS),
Common Internet File System (CIFS), Hypertext Transfer Protocol (HTTP), and Component Object
Model Plus (COM+). This setting overrides the Access this computer from the network setting when a
user account is subject to both policies. Configuring this user right for other groups could limit the
ability of users to perform delegated administrative tasks on the network. In section 2.8, this guide
recommends including the Guests group in the list of users and groups assigned this right to provide
the highest level of security possible. Nevertheless, the IUSR account used for anonymous access to IIS
is by default a member of the Guests group. This guide recommends removing the Guests group from
the Incremental IIS Group Policy to ensure anonymous access to IIS servers can be configured when
necessary. For these reasons, the Deny access to this computer from the network setting is configured
to include ANONOYMOUS LOGON; Built-in Administrator; Support_388945a0; Guest; all NON-
Operating System service accounts for IIS servers in all three environments defined in this guide.
Deny access to this computer from the network
Legacy Client
ANONOYMOUS
LOGON; Built-in
Administrator, Guest;
Support_388945a0; all
NONOperating System
service accounts
112
Enterprise Client
ANONOYMOUS
LOGON; Built-in
Administrator, Guest;
Support_388945a0; all
NONOperating System
service accounts
High Security Client
ANONOYMOUS
LOGON; Built-in
Administrator, Guest;
Support_388945a0; all
NONOperating System
service accounts