System cryptography: Force strong key protection for user keys stored on the computer

-

i have been going through server hardening procedure our servers related network application.  this application employs use of proxy/bridge app server connected back-end database server (all windows server 2003 r2).  this security policy setting cis recommends settings "user must enter password each time use key" recommended.  i applying setting proxy/bridge, app server , database respectively.

would prevent service on 1 of servers using it's certificate unless user logged in accept use of certificate , enter password? i'm not sure how setting affect server-to-server traffic...

hi,

> prevent service on 1 of servers using it's certificate unless user logged
> in accept use of certificate , enter password?

no. according definition of policy “system cryptography: force strong key protection user keys stored on computer”, policy setting determines whether users can use private keys without password. services or computer use computer certificate, it’s not include in policy setting.

> i'm not sure how setting affectserver-to-server traffic...

nothing, setting not affects server-to-server traffic, since no user certificate involved.

i think should read below articles understand policy setting.

security options
http://technet.microsoft.com/en-us/library/dd349805(v=ws.10).aspx#bkmk_56
system cryptography: force strong key protection user keys stored on computer
http://technet.microsoft.com/en-us/library/cc738035(v=ws.10).aspx
what strong key protection in windows?
http://blogs.technet.com/b/pki/archive/2009/06/17/what-is-a-strong-key-protection-in-windows.aspx

lawrence

technet community support



Windows Server  >  Group Policy



Comments

Post a Comment

Popular posts from this blog

directory stack

-
witchcraft>> $algo -eq $null true witchcraft>> cd $algo.key # directory stack: --- ---------------- 0 c:\users\voodoomsr\valhala 1 c:\users\voodoomsr\valhala\witchcraft\expectopatronum 2 c:\users\voodoomsr\valhala\witchcraft\expectopatronum\comunidad 3 c:\users\voodoomsr\valhala\witchcraft\expectopatronum\comunidad\stack 4 c:\users\voodoomsr\valhala -> 5 c:\users\voodoomsr\valhala\witchcraft witchcraft>> hi all, found extrange thing don't understand. if execute set-location inexistence object list of directories. what that? i see it, can't reproduce it.   when enter you've got posted there, set-location error, because value of argument "path" null.     [string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " " mistake!. after that, check alias cd , asigned function set-locationex. fu...
Read more

PowerShell List

-
hello everyone, i'm trying list vms in scvmm i'm using get-vm -vmmserver vmm01.mydomain.tld | export-csv c:\listvm.csv but returns info each vm, return properties want, way (that know) properties using: get-vm -vmmserver vmm01.mydomain.tld | format-list -property name, owner, description, operatingsystem, cpucount, memory, virtualizationplatform, hostname, status but if add get-vm -vmmserver vmm01.mydomain.tld | format-list -property name, owner, description, operatingsystem, cpucount, memory, virtualizationplatform, hostname, status | export-csv c:\listvm.csv now have mess... any way working nice , clean? thank you ok, found solution get-vm -vmmserver vmm01.mydomain.tld | select name, owner, description, operatingsystem, cpucount, memory, virtualizationplatform, hostname, status | export-csv c:\listvm.csv thank you. Windows Server  >  ...
Read more

Dns access list

-
hello i have situation following participants: mac osx server & windows 2003 dns server   problem: the mac osx server registering ip address in dns. i not want that. question: is there way control can register in windows dns? some sort of access list. know possible bind dns server regards k you have few options available in dns regarding dynamic updates.  can set zone's dynamic updates settings 1 of following: none, nonsecure , secure, , secure only. if set none, dynamic updates not allowed, nonsecure , secure allow clients update , secure only allow authenticated systems (members of domain example). if want control updates @ record level, can modify acl record once has been created.  zone can controlled via acl (properties, security tab). visit: anitkb.com , knowledge base. Windows Server  >  ...
Read more