[Windows Security Settings] Windows2003 Server Settings

xiaoxiao2021-03-06  39

First, Windows Server 2003 3790 version identification

RTM = release to manufacture (public issued mass production) is the version of the hardware manufacturer! It is sent to the pressure plate, not taken to sell.

OEM = Original Equipment Manufacture can only be installed new, and RTM is almost, but it is different.

RTL = Retail (retail) official retail version, you can upgrade or brand new installation.

VLK = Volume License is a large number of authorized version, also known as the enterprise version. No activation is required. (On the so-called Simplified Chinese VLK version is actually the eight documents in the ordinary Simplified Chinese version plus English VLK version)

Second, the different versions of Windows Server 2003

Windows Server 2003 Web Edition: Provides a web hosting and service platform for rapid development, deploying web services and applications. Support 2 SMP (symmetric multiprocessing) system, 2GB memory.

Windows Server 2003 Standard Edition: For small and medium-sized businesses and departmental applications. Support 4 channels SMP, 4GB memory.

Windows Server 2003 Enterprise: Suitable for central and large organizations, 32-bit and 64-bit versions. Supports 8 node clusters, NUMA; supports 8-channel SMP, where 32-bit supports 32GB memory, and 64GB memory is supported.

Windows Server 2003 Data Center Edition: Business-oriented enterprises that require strong scalability and high availability, with 32-bit and 64-bit versions. 32-bit version support 32 channels SMP, 64GB memory; 64-bit support 64-way SMP, 512GB memory; two versions support 8 node clusters, NUMA

Third, the activation of Windows Server 2003 3790 version

Before the official version of the model is not coming out, the popular activation is now the following: (1) RESET5.02, running in security mode, activating, time adjustment to 2008, no problem, all use normal. Can be upgraded. Disadvantages: The activation program is completely shielded, and it is manifested to run MSOOBE / A without any display, and there is a reset5 in the service. When the machine will automatically run this service, C: /Windows/system32/srvany.exe, this program should be reset5 Add Enter the system.

(2) Russian crack, remember in the XP era, just replace setupreg.hiv, then the phone can achieve the perfect activation of the realm, can be in 2003, after doing this, the current display is activated, if you Adjusting time will then boot, it will be activated, or even can't be used. Estimated the key to the second issue or in that setupReg.hiv file.

(3) Someone posted a file with WinXPactiVation.exe on the forum, and claims that it can be activated. In fact, this is also a false activation, temporarily blocking the activation program, is not able to modify the time.

(4) Pseudo VLK made with replacement method, there is no problem with installation, just cannot be upgraded. VLK is the 8 files that replace the English version. But SN has been sealed by Microsoft. So can't be upgraded, but this method is the most stable, there is no problem.

Conclusion: It is recommended that everyone is activated and replan5.02 activation with 8 replacement activities!

Fourth, some optimization settings for Win 2003 Server

1. Disable Configure Server Wizard

Prohibition of "Configuring your Server" wizard: In the Control Panel -> Administrative Tools -> Manage your server (Manage Your Server), then on the window Don't display this at logon when you check in the lower left corner. 2. Enable hardware and DirectX acceleration

★ Hardware Acceleration: Desktop Click Right click - Properties -> Settings - Advanced - Troubleshoot. Pull the hardware accelerated scroll bar to "Full" (FULL), it is best to click "OK" to save exit. The black screen that may appear in this period is completely normal.

★ DirectX Acceleration: Open "Start" -> "Run", type "dxdiag" and enter "DirectX Diagnostic Tool", in the Display page, click DirectDraw, Direct3D and AGP Texture Accelerates three buttons Enable acceleration. Pull the strip of the "Hardware Sound Acceleration Level" (full acceleration).

3. Enable the sound card

After the system is installed, the sound card is disabled, so it is necessary to set it in the taskbar after the control panel -> sound -> enabled and restart. If you are using the Windows Server 2003 standard version, please from the second step XX because the standard version has allowed sound services. ★ Open "Start" -> "Run", type "Services.msc", find "Windows Audio" in the window, and double-click it, then select the drop-down menu of the startup mode (STARTUP TYPE) Automatic, click "Apply" -> "Start" -> "OK" (OK)

★ Open "Start" -> "Run", type "dxdiag" and enter "DirectX Diagnostics" (DirectX Tools), accelerate the hardware of the Sound "page The Hardware Sound Acceleration Level scroll bar pulls to "Full Acceleration).

4. How to enable ASP support

Windows Server 2003 default installation, is not installed, you need to install additional installation. After installing IIS 6, you also need to open support for ASP separately. The method is: Control Panel -> Management Tools -> Web Service Extensions -> Active Server Pages -> Allow. 5. How to enable XP desktop topics

★ Open "Start" -> "Run", type "Services.msc", select Themes "Theme" (the default is forbidden), then change to "Auto", press "Apply", select " "Open". ★ On the "desktop" attribute, select "Windows XP" ★ My Computer ---- Properties ---- Advanced ---- Performance ----- Used on the desktop Tab shadow

6. Shuttle reasons for shutdown when shutdown

Shutdown Event Tracker is also a setting of Windows Server 2003 from other workstation systems. This is a necessary choice for the server, but it is useless for the workstation system. We can also disable it. Open "Start ->" Run "GPEDIT.MSC", select "Computer Configuration" -> "Administrative Templates ->" System "(SYSTEM), double-click" Shutdown Event Tracker "in the changing dialog box to select" Disabled ", click" OK "to save, so you will see similar to Windows Power off window 2000

7. How to use a USB hard drive, a U disk, add a partitioned hard disk

My computer (click Right button) ---- Management ---- Disk Management ----- Execute the import and assignment of the import and assign from the corresponding hard disk **

8. Display all components in the control panel Replace "hide" in the SYSOC.INF file in the Windows / Inf directory.

9. Disabling Internet Explorer Enhanced Security and disable security interrogation boxes Customize the security level for setting IE in the IE tool option. The scroll bar is pulled on the Security tab to set the Internet area to "Medium" or "medium low". Custom settings Select the "prompt" to select "Disable" or "Enable".

10. Disable boot Ctrl Alt Del and implement automatic landing

★ Method 1: Open the registry (run -> "regedit"), open: hkey_local_machin | Software | Microsoft | Windows NT | CURRENTVERSION | WINLOGON segment, press Right-click in this paragraph, newly built two string segments, autodminLogon = " 1 ", defaultpassword =" Password set for superuser administrator ". Note that you must set a password for the Administrator, otherwise you cannot achieve self-start. Then, restart Windows to automatically log in.

★ Method 2: Management Tools -> Local Security Settings -> Local Policy -> Security Options -> Interactive Logon: Do Not Require Ctrl Alt Del, enabled. ★ Method 3 (Automatically login): Use Windows XP's TWEAK UI to implement server 2003 automatic login. Download: Tweak ui http://www.ssite.org/uppic/sun_pic/...003/tweakui.exe Download Download Tweakui.exe in the left panel Select Logon -> Autologon -> Check Log on the right ON Automatically At System Startup Enter your username and domain name (if not written), click below set password, enter the password of the username, then click OK.

11. Hidden files

Windows Server 2003 is displayed by default, if you don't want this, you can hide by way: Open any folder, select the tool (Tools) -> folder option (Folder Options) -> View ( View, adjust the contents of the display system folder, hide protected ** as system files, hide files, and folders.

12. Allow built-in IMAPI CD-Burning services and support Windows Imaging Device Services

Allow built-in IMAPI CD-Burning services and support Windows Imaging Device Services ★ If you want to enable Windows built-in IMAPI CD-Burning services. Do the following XX: Open "Start" -> "Run", type "services.msc", find "IMAPI CD-Burning COM Service" in the window, and double-click it, then start mode (Startup type) drop-down menu Select "Automatic" and click "Apply" -> "Start" -> "OK" (OK)

★ If you have image devices such as digital cameras and scanners, you should open the Windows Image Acquisition service. Open "Start" -> "Run", type "Services.msc", find "Windows Image Acquisition (WIA)" and double-click on the window, then start mode (startup type) The drop-down menu selects "Automatic" and click "Apply" -> "Start" -> "OK"

13. Advanced settings

★ We can modify some of the advanced settings of Windows Server 2003 to fit the application environment for the workstation. Right click on "My Computer" - Advanced - Perform - Setting - Advanced, put "Processor Plan" Scheduling) and memory usage are assigned to "Programs". Then click "OK" (OK.) ★ Disable Error Report Right-click "My Computer" - Advanced - Click the "Error Reporting" button, "Disable Error Reporting" is selected and checks me in the window, but notify me when a serious error occurs (But, Notify Me When critical Errors Occur.)

★ Adjusting some friends of the virtual memory often feel that the shutdown and cancellation slowly, the solution is to disable virtual memory so that your logout and shutdown time may speed up. Right-click My Computer - Properties - Advanced - Performance - Setting - Advanced, click on "Virtual Memory" ) Part "Change" and then select "No Page File" in the window. Restart the system.

14. Accelerate start and run speed

★ modify the registry to reduce pre-reading, reducing the waiting time progress bar: Start → Run → regedit start the Registry Editor, HKEY_LOCAL_MACHINE / SYSTEM / CurrentControlSet / Control / Session Manager / Memory Management / PrefetchParameters, there is a key named EnablePrefetcher Its value is 3 and change it to "1" or "5". Find hkey_local_machine / system / currentControlSet / Control, set WaitTokillServentimeout to: 1000 or smaller. (Original Setting: 20000) Find the HKEY_CURRENT_USER / Control Panel / Desktop button, change the waittokillapptimeout of the right window to 1000, (Original setting: 20000) is only waiting for 1 second. Change the HungappTimeout value to: 200 (original setting: 5000), waiting for the program to wait for 0.5 seconds. ★ Let the system automatically turn off the program that stops responding. Open the Registry HKEY_CURRENT_USER / Control Panel / Desktop button, set the autoeeendtasks value to 1. (Original setting: 0)

★ Disable System Services QoS Start Menu → Run → Type GPEDIT.MSC, appear "Group Policy" window, expand "Management Templates" → "Network", expand "QoS Packet Scheduler", right-click "limit Reserved Bandwidth, "Settings" in the "Settings" in the properties, "Restrictions can be reserved", select "Disabled", and determined. When the above modifications are completed and applied, if the "QoS Packet Scheduler" can be seen in the General Properties tab in the network connection property dialog box. Description Modification is successful, otherwise the modification fails.

★ Change the speed of the window pop-up: Find the hkey_current_user \Control Panel \ DESKTOP \WindowMetrics sub-key branch, find the MINanImate key value in the window, the type of REG_SZ, by default is 1 value of 1, indicates that the open window is displayed Animation, change it to 0, prohibit animation display, followed by selecting the "Logout" command from the Start menu to activate the modifications you just made.

★ Disable Windows XP compression function: Click "Run" under "Start", enter "Regsvr32 / U Zipfldr.dll" in the "Run" input box, and then press Enter key.

★ Set personality start messages or warning information: Personalized Windows XP boot: Open the Registry Editor, find hkey_local_machine@wwware\microsoft 帖子 帖子 帖子, Double-click LegalnoticeCaption July, Open "Edit String "Dialog, enter your own information title in the text box under" Numerical Data ", such as" buddy, hello! ", Then click" OK "and restart. If you want to change the warning message, you can double-click the LegalNoticeText health name. In the "Edit String" window that appears, enter the warning message you want to display, click OK, restart. 15. Installing Java VM Windows Server 2003 does not integrate MS Java VM or Sun Java VM, you can download and install it yourself.

16. Install DirectX 9A

Installing DirectX 9A on Windows Server 2003 and the method of installing DirectX 9A on other versions of Windows is the same. DirectX and Graphics Acceleration must be enabled before installation.

17. Available anti-virus software and firewall Symantec Norton Antivirus Corporate 8.01Zone Alarm 3.7.159Norton Personal FireWall 2003

5. How to prevent IPC $ invading

1. Prohibition of empty connections (this ** does not block the establishment of empty connections)

First run the regedit, find the following set [HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / CONTROL / LSA] to change the key value of Restrictanonymous = DWORD to: 00000001. Restrictanonymous REG_DWORD 0X0 default 0x1 anonymous users Unable to list this unit list 0x2 Anonymous users Unable to connect to this IPC $ Sharing Description: Not recommended 2, otherwise you may cause some of your services to be unable to start, such as SQL Server

2, prohibiting the default sharing

1) Look at the local shared resource run -CMD-Enter net Share2) Delete Sharing (one Enter one) NET Share IPC $ / DeleTeNet Share Admin $ / DeleTeNet Share C $ / DeleTeNet Share D $ / Delete (if there is e, f, ... can continue to delete) 3) Modify the registry to remove the sharing run -Regedit finds the following primary key [HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / SERVICES / LANMANSERVER / Parameters] change the button value of AutoShareserver (DWORD) to: 00000000. If the primary key mentioned above does not exist, you will be built (right-click-new-double-byte value) a primary and re-change key value.

3, stop Server service

1) Temporarily stop Server service Net Stop Server / y (Re-enable the Server service) 2) Permanently close the IPC $ and the Default Sharing Related Service: LanmanServer, Server Service Control Panel - Administrative Tool - Services - Find the Server Service ( Right-click) - Property - General - Start Type - Disabled

4, install the firewall (check related settings), or port filtering (filtered out 139, 445, etc.)

1). Unlock the file and printer sharing binding mouse to the desktop [Network Neighbor] → [Properties] → [Local Connection] → [Properties], remove the "Microsoft Network's File and Printer Sharing" Files and printer sharing bindings. This will prohibit all requests from 139 and 445 ports, and others will not see the sharing of this unit. 2). Use the TCP / IP filter mouse to click on [Network Neighbor] → [Properties] → [Local Connection] → [Properties] to open the Local Connection Properties dialog. Select [Internet Protocol (TCP / IP)] → [Properties] → [Advanced] → [Option] to click the "TCP / IP Filter" option in the list. Click the [Properties] button, select "Allow", then click the [Add] button (as shown in Figure 2), fill in the port other than 139 and 445. This will not respond when others use the scanner to scan the 139 and 445 ports.

3). Use the IPSec Security Policy to block access to port 139 and 445 [My Computer] → [Control Panel] → [Management Tool] → [Local Security Policy] → [IP Security Policy, in Local Machine], here Define a IPSec security policy rule that blocks any IP addresses from accessing IP addresses from TCP139 and TCP445 ports, so that others use scanner scans, the 139 and 445 ports of this unit will not respond.

4). Use firewall defense attacks in the firewall to block other machines from sharing using this machine. For example, in the "Skynet Personal Firewall", select an empty rule, set the packet direction for "reception", the other party IP address "any address", the protocol is set to "TCP", the local port is set to "139 to 139" The other port is set to "0 to 0", the setting flag bit is "SYN", the action is set to "Interception", finally click the [OK] button, and check this rule in the "Custom IP rule" list. Start intercept 139 port attack (Figure 3).

5, set complex passwords for all accounts to prevent passwords via IPC $

6. Various VLK version of Windows online update (Win2003 Server can also)

The following address is suitable for a variety of VLK versions of Windows online updates (actually downloading the update package from the Microsoft Site, then installing it). This method does not check the legality of the serial number as the XP built-in online update. It has been tested and available. Online Update: http://v4.windowsupdate.microsoft.com/zhcn/default.asp? Corporate = true (http://www.fuwu.net.cn/Article/showArticle.asp?articleID=75)

转载请注明原文地址:https://www.9cbs.com/read-53080.html

New Post(0)