Steven
Fri Sep 23 19:33:50 CDT 2005
You can disable the server service. You will lose the ability to use
Microsoft Baseline Security Analyzer to scan those servers remotely, lose
the ability to use Computer Management to manage them remotely, not be able
to run a RSOP on them in logging mode from a domain controller, use any
command line tools that rely on SMB, and probably a few other significant
things. Another solution would be to use ipsec to protect your servers. For
instance you could have an ipsec policy to allow all access to/from domain
controllers and only specific admin workstations for file and print sharing.
Ipsec negotiation policies require computer authentication and then can
protect data with encryption and insuring integrity. You can always use
Group Policy computer configuration to manage services at a later time. See
the link below on ipsec and a strategy that can be used to protect domain
computers. Ipsec strategy must be well planned and tested with special
attention placed on domain controller traffic being exempt from ipsec
negotiation with domain computers. The Windows 2003 Server Security guide
has specific recommendations on services for servers for baseline
configuration and based on role.
http://www.microsoft.com/technet/security/topics/architectureanddesign/ipsec/default.mspx
http://www.microsoft.com/technet/security/prodtech/windowsserver2003/W2003HG/SGCH00.mspx
"sd" <sd@discussions.microsoft.com> wrote in message
news:5D605A6F-F034-4D2D-A096-DA16D38E36A7@microsoft.com...
> While designing a secure standard base image for WinSvr2003std the issue
> of
> weather non-file servers need SMB enabled came up.
> I proposed the alternative of OpenSsh which will allow file transfer and
> remote execution over a secure and encrypted session.
> Question: if we disable SMB what will stop working? SMS, AD software
> distribution, Manage another computer?