
YuChakTinMichael‘sGIACGCFWProjectAssignment
Page 52
Step6Removeunusedandpotential lydangerouscomponents.
TheOS2andPosixsubsystemsareobsoleteanduselessinourcontext.Theycanbe
removedusingthemethodsuggestedbyPhilipCox(above):
“…youcanremovetheOS2andPosixregistryvaluesfromthe
HKLM\System\CurrentControlSet\Control\SessionManager\SubSystemsregistry key.
Thendeletetheassociatedfiles(os2*,posix*,andpsx*)intheDLLcachedirectory,
thenfrom %systemroot%\System32(otherwisewindowsfileprotectionwill
immediatelyreplacethem).”
13
Also,thefollowingcommandsshouldeitherberelocatedtosomeotherlocationsorto
betightenedupwithstrongerACLsettings.Youdonotwantthemtobeaccessedand
usedbythehackers:
n arp.exe
n at.exe
n atsvc.exe
n attrib.exe
n cacls.exe
n clipsrv.exe
n cmd.exe
n command.com
n cscript.exe
n debug.exe
n dialer.exe
n edit.com
n edlin.exe
n finger.exe
n ftp.exe
n hypertrm.exe
n ipconfig.exe
n nbtstat.exe
13
http://www.sysexp.com/win2k/hardenW2K12.pdf
Comentarios a estos manuales