Windows XP Common Security Settings List

It is better to combine 8 or more alphanumeric symbols, or even special characters, usually 1 month to 2 months Change your password regularly.
Deleting a Share

Viewing the current share can be done by entering net share at the command line, or by using the Control Panel —— Computer Management, click <;System Tools”——“Share Folder ”——“Share”View.

net share admin$ /delete

net share c$ /delete,...other drive shares are deleted in turn
forbid IPC$ empty connections

at start &mdash ;— Run, type regedit, change the RestrictAnonymous value of the registry HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa from 0 to 1. The machine needs to be restarted to take effect.

But after the above registry is modified, restarting the machine is only forbidding to establish an empty connection. The IPC$ service will still start. If you want to completely disable it, you can directly control the control panel ——administrative tool—— Stop the right server service first, then disable it, but this will also affect network sharing, etc. You can start the service yourself when you need to share it.
Close 139 port

Right click on the network neighborhood & mdash;— local connection, select "Internet Protocol (TCP/IP)", click Properties, click Advanced..., select ”“WinS” There is a "NETBIOS" for disabling TCP/IP.
Close port 445

At the beginning —— run, type regedit, create a new key in HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters in the right window, name SMBDeviceEnabled, type REG_DWORD, key value 0.
Close 3389 Port

Right mouse click "My Computer", select Properties, click Remote, and uncheck both Remote Assistance and Remote Desktop.
Disabling Services

Control Panel ——Administrative Tools——Services, Turn off the following services:

1. Alerter——Notify selected users and computers about system management level alerts ( Suggested to close)

2, ClipBook——Enable “Scrapbook Viewer&#"Save information and share it with remote computers (recommended to close, if you find problems when using sharing, check this setting by the way)

3, Distributed Link Tracking Server—— used for LAN update connection information (individual users do not need to change manually), change Distributed Link Tracking Client to manual

4, Indexing Service—— Indexed content and attributes of files on local or remote computers (recommended)

5, Messenger—— messenger service (recommended)

6. NetMeeting Remote Desktop Sharing—— Users access each other on the network via NetMeeting (recommended off)

7 , Network DDE—— provides dynamic data exchange for programs running on the same computer or on different computers (recommended shutdown)

8. Network DDE DSDM——Manage Dynamic Data Exchange (DDE) Network Sharing] (Recommended to close)

9. Performance Logs And Alerts—— Record machine health and write to the log or issue a warning (optional off)

10, Remote Desktop Help Session Manager— — Remote Help Service (recommended)

11. Remote Registry—— enables remote computer users to modify the local registry (recommended to close)

12, Routing and Remote Access—— LAN and wide area to provide routing services (close if not clear)

13, Server— — support this computer through the network file, print, and named pipe sharing (if you do not need to share the file printer, Can be turned off)

14, TCP /IPNetBIOS Helper & mdash; & mdash; provide NetBIOS and network on TCP /IP services Support for NetBIOS name resolution on the client allows users to share files, print and log in to the network (if your network does not use Netbios or WINS, it is recommended to turn it off)

15. Telnet—— Allow remote users to log in This computer runs the program (recommended to close)

16, Terminal Services—— remote login to the local computer (recommended off)

17, Window s Image Acquisition (WIA)—— Photo services, applications and digital cameras (occasionally used by individual users)
Local Policies

Open: Management Tools ——Local Security Policy——Local Policies——Audit Policy,

1. Audit policy change (select success failed)

2. Audit login event (select success failed)

3. Audit object access (select failed)

4. Audit trail process (no audit)

5. Audit directory service access (option failed)

6. Audit privilege use (select Select failure)

7. Audit system events (select success failed)

8. Audit account login time (select success failed)

9. Audit account management (selected successfully Failed)
Local Security Policy

Open: Administration Tools ——Local Security Policy——Local Policies——Security Options,

1. Interactive Login: No need Press Ctrl+Alt+Del (enabled)

2. Interactive login: Do not display the last username (disabled)

3. Network access: Do not allow anonymous enumeration of SAM accounts (Enable)

4. Network access: Anonymous sharing (delete values ​​in policy settings)

5. Network access: Anonymous named pipes (values ​​in policy settings) Delete)

6. Network access: Remotely accessible registry path (delete the values ​​in the policy settings)

7. Device: Limit CD-ROM access to local login User (enabled)
Account

Open: Management Tools & mdash;—Local Security Policy——Local Policies——Security Options,

Disable guest account, system default administrator administrator renamed, changed to only know by yourself The name, the number of digits is not too small, the account used daily is preferably not in the administrators group.
User Rights Assignment

Open: Administration Tools ——Local Security Policy——Local Policies——User Rights Assignment,

1. Access this computer from the network, if You don't need to be able to delete all except administrators.

2. Force shutdown from the remote system and delete all accounts.

3. Refuse to access this computer from the network and delete the SUPPORTxxx account.
User and Group Policy

Open: Administrative Tools & mdash; — Computer Management & mdash; & mdash; Local Users and Groups — — User, delete Support_388945a0 and HelpAssistant accounts.
Disable automatic opening of the default share Modify the registry [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters] to change the key value of AutoShareWks or AutoShareServer to: 0. If it does not exist, create the DWORD key value, AutoShareWks corresponds to the professional version, and AutoShareServer corresponds to the SERVER version.

Supplement:

1. View the default share: Run CMD and enter net share

2. View the local port: Run CMD and enter the command netstat -a< Br>

3. TCP/IP filtering settings for Windows:

Control Panel ——Network and Dial-up Connections——Local Connections——INTERNET Protocol (TCP/IP)— — Attribute ——Advanced——Options——TCP/IP Filtering—— Attributes, add the required TCP and UDP ports.

4, temporarily use the computer to temporarily leave the computer, remember to lock the computer.