Policy Knowledge Base

Policy Commander delivers powerful security policy management that improves the overall security state of your network, and helps you comply with data privacy and security provisions of regulatory mandates. The Security Policy Knowledge Base utilized by Policy Commander is a constantly growing online repository of security policies authored and validated by New Boundary Technologies. The following index provides a sample of the policies you will find in the Security Policy Knowledge Base.

If you’d like to see for yourself the power and simplicity of Policy Commander, we invite you to download a 30-day trial version. You can use the trial version to test Policy Commander on up to 20 workstations and servers. Click below to download your trial version of Policy Commander.

	Microsoft Security Template Policies
	Payment Card Industry (PCI) Compliance Guide (Please see PCI Guide tab at the top of this page)
	Best Practices – Data Protection Policies
	XP Lockdown Guide (Please see XP Lockdown Guide tab at the top of this page)
	Best Practices – Disable Services
	NIST Windows XP Security Template Policies
	NIST Windows XP Security Policy Modules
	NIST Windows 2000 Security Template Policies
	NSA Security Template Policies
	HIPAA Security Policies

HIPAA Security Policies

Automatic log off after period of inactivity

This automatic log off policy can be implemented to minimize the likelihood that an unauthorized individual may access the workstation

Disable the Print Screen key

This policy disables the Print Screen key.

Disable the use of USB storage devices

This policy prevents users from connecting to USB storage devices.

Prevent writing to USB storage devices

This policy prevents write operations to USB block storage devices, such as memory sticks.

Secure a file

This sample policy demonstrates how you can ensure that a file can only be accessed by authorized users.

Secure Electronic Protected Health Information

This sample policy demonstrates how you can ensure that Electronic Protected Health Information (ePHI) can only be accessed by authorized users.

NIST Windows XP - 2.1 Local Policies - Audit Policy Settings

Use this policy to configure the system audit settings consistent with the NIST recommendations for Windows XP.

NIST Windows XP - 2.2 Local Policies - User Rights Assignment Settings

This policy assures that User Rights Assignments are consistent with the NIST recommendations.

NIST Windows XP - 2.3 Local Policies - Security Options - Control system shut down when unable to log security audits

This policy assures compliance with the NIST recommendation that computers should be configured to shut down immediately when security events cannot be written to the Security log file.

NIST Windows XP - 2.3 Local Policies - Security Options - FIPS Certified Cryptography

This policy assures compliance with the NIST recommendation for the use of FIPS (Federal Information Processing Standards ) compliant algorithms for encryption, hashing, and signing in Windows XP High Security environments.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden Devices settings

This policy assures that Devices settings are consistent with the NIST recommendations for strengthening Devices security options to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden Domain Member settings

This policy assures that Domain member settings are consistent with the NIST recommendations for strengthening Domain member security options to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden Microsoft network client settings

This policy assures that Microsoft network client settings are consistent with the NIST recommendations for strengthening Microsoft network client security options to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden Microsoft network server settings

This policy assures that Microsoft network server settings are consistent with the NIST recommendations for strengthening Microsoft network server security options to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden network access settings

This policy assures that the network access settings are consistent with the NIST recommendations for restricting which types of network access may be performed, in order to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden network security settings

This policy assures that the network security settings are consistent with the NIST recommendations for strengthening the network security settings, in order to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden Recovery console settings

This policy assures that Recovery console settings are consistent with the NIST recommendations for strengthening Recovery console security options to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden System objects settings

This policy assures that the System objects settings are consistent with the NIST recommendations for strengthening System objects security options to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden the Interactive logon settings

This policy assures that the interactive logon settings are consistent with the NIST recommendations.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden the Shutdown settings

This policy assures that shutdown settings are consistent with the NIST recommendations.

NIST Windows XP - 2.3 Local Policies - Security Options - Limit local account use of blank passwords to console only

This policy assures that this setting is enabled, consistent with the NIST recommendation.

NIST Windows XP - 3.0 Event Log Policy Parameters

This policy assures that the Event Log settings are consistent with the NIST recommendations.

NIST Windows XP - 4.0 Restricted Groups Settings

This policy removes all users from the Remote Desktop Users and Power Users groups.

NIST Windows XP - 5.0 System Services Settings

This policy disables and secures the services that the NIST guidance indicates are unnecessary for Windows XP.

NIST Windows XP - 6.0 File Permission Settings

This security policy restricts access to 26 operating system executables, protecting them from unauthorized modification and usage.

NIST Windows XP - 7.0 Registry Permission Settings

This security policy restricts access to these critical registry keys.

NIST Windows XP - 8.1 Registry Values - Debugging

This policy disables the Dr. Watson program debugger, and disables creation of the Dr. Watson memory dump file.

NIST Windows XP - 8.2 Registry Values - Automatic Functions - Disable automatic logon

This policy assures that the automatic logon feature is disabled.

NIST Windows XP - 8.2 Registry Values - Automatic Functions - Disable automatic reboot

This policy assures that the automatic reboot feature is disabled.

NIST Windows XP - 8.2 Registry Values - Automatic Functions - Disable Automatically Running CD-ROMs

This policy assures that the automatic execution of CD-ROM content is disabled.

NIST Windows XP - 8.3 Registry Values - Networking - Harden the Microsoft TCPIP stack settings

This policy assures that the Microsoft TCP/IP stack settings are configured to be consistent with the NIST recommendations.

NIST Windows XP - 8.3 Registry Values - Networking - Strengthen miscellaneous networking settings

This policy assures that the networking settings are consistent with the NIST recommendations.

Top

Best Practices - Data Protection Policies

Automatic log off after period of inactivity

This automatic log off policy can be implemented to minimize the likelihood that an unauthorized individual may access the workstation

Disable the Print Screen key

This policy disables the Print Screen key.

Disable the use of USB storage devices

This policy prevents users from connecting to USB storage devices.

Prevent writing to USB storage devices

This policy prevents write operations to USB block storage devices, such as memory sticks.

Disable Remote Login

This policy stops users from logging in to the computer from remote machines.

Secure a file

This sample policy demonstrates how you can ensure that a file can only be accessed by authorized users.

Secure a folder

This sample policy demonstrates how you can ensure that a folder can only be accessed by authorized users.

Secure Electronic Protected Health Information

This sample policy demonstrates how you can ensure that Electronic Protected Health Information (ePHI) can only be accessed by authorized users.

Top

Best Practices - Disable Services

Disable Computer Browser Service

This policy disables the Computer Browser Service.

Disable Error Reporting Service

This policy stops your computers from reporting error information to Microsoft when an application crashes.

Disable IIS on unauthorized computers

IIS should not be operational unless the computer has the "IIS Server" role.

Disable Messenger Service

This policy stops the Microsoft Messenger Service from popping up broadcast messages on your computers. This is not related to the MSN Messenger Instant Messaging program.

Disable Remote Registry Service

This policy stops users from connecting to a computers registry from a remote machine.

Disable RPC Service

This policy turns off the Remote Procedure Call (RPC) Service (a service that allows remote computers to programmatically execute commands on client machines).

Disable Task Scheduler Service

This policy stops the Task Scheduler Service from launching applications at scheduled times.

Disable TCP/IP NetBIOS Helper Service

This policy disables the TCP/IP NetBIOS Helper Service (a service that is typically only necessary if your network still uses the Windows Internet Name Service (WINS) protocol).

Disable the Server Service

This turns off a service which provides support for file and print serving as well as RPC.

Disable Windows Update

This policy disables the "automatic update" feature of Windows Update.

Disable Wireless Zero Configuration Service

This policy turns off automatic configuration of Wi-Fi connections.

Top

NIST Windows XP Security Template Policies

NIST Windows XP Enterprise Client (Revision 1.0.2)

NIST Windows XP High Security (Revision 1.0.2)

NIST Windows XP Legacy (Revision 1.0.2)

NIST Windows XP SOHO (Revision 1.0.2)

Top

NIST Windows XP Security Policy Modules

NIST Windows XP - 2.1 Local Policies - Audit Policy Settings

Use this policy to configure the system audit settings consistent with the NIST recommendations for Windows XP.

NIST Windows XP - 2.2 Local Policies - User Rights Assignment Settings

This policy assures that User Rights Assignments are consistent with the NIST recommendations.

NIST Windows XP - 2.3 Local Policies - Security Options - Control system shut down when unable to log security audits

This policy assures compliance with the NIST recommendation that computers should be configured to shut down immediately when security events cannot be written to the Security log file.

NIST Windows XP - 2.3 Local Policies - Security Options - FIPS Certified Cryptography

This policy assures compliance with the NIST recommendation for the use of FIPS (Federal Information Processing Standards ) compliant algorithms for encryption, hashing, and signing in Windows XP High Security environments.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden Devices settings

This policy assures that Devices settings are consistent with the NIST recommendations for strengthening Devices security options to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden Domain Member settings

This policy assures that Domain member settings are consistent with the NIST recommendations for strengthening Domain member security options to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden Microsoft network client settings

This policy assures that Microsoft network client settings are consistent with the NIST recommendations for strengthening Microsoft network client security options to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden Microsoft network server settings

This policy assures that Microsoft network server settings are consistent with the NIST recommendations for strengthening Microsoft network server security options to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden network access settings

This policy assures that the network access settings are consistent with the NIST recommendations for restricting which types of network access may be performed, in order to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden network security settings

This policy assures that the network security settings are consistent with the NIST recommendations for strengthening the network security settings, in order to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden Recovery console settings

This policy assures that Recovery console settings are consistent with the NIST recommendations for strengthening Recovery console security options to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden System objects settings

This policy assures that the System objects settings are consistent with the NIST recommendations for strengthening System objects security options to achieve greater security than the default settings provide.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden the Interactive logon settings

This policy assures that the interactive logon settings are consistent with the NIST recommendations.

NIST Windows XP - 2.3 Local Policies - Security Options - Harden the Shutdown settings

This policy assures that shutdown settings are consistent with the NIST recommendations.

NIST Windows XP - 2.3 Local Policies - Security Options - Limit local account use of blank passwords to console only

This policy assures that this setting is enabled, consistent with the NIST recommendation.

NIST Windows XP - 3.0 Event Log Policy Parameters

This policy assures that the Event Log settings are consistent with the NIST recommendations.

NIST Windows XP - 4.0 Restricted Groups Settings

This policy removes all users from the Remote Desktop Users and Power Users groups.

NIST Windows XP - 5.0 System Services Settings

This policy disables and secures the services that the NIST guidance indicates are unnecessary for Windows XP.

NIST Windows XP - 6.0 File Permission Settings

This security policy restricts access to 26 operating system executables, protecting them from unauthorized modification and usage.

NIST Windows XP - 7.0 Registry Permission Settings

This security policy restricts access to these critical registry keys.

NIST Windows XP - 8.1 Registry Values - Debugging

This policy disables the Dr. Watson program debugger, and disables creation of the Dr. Watson memory dump file.

NIST Windows XP - 8.2 Registry Values - Automatic Functions - Disable automatic logon

This policy assures that the automatic logon feature is disabled.

NIST Windows XP - 8.2 Registry Values - Automatic Functions - Disable automatic reboot

This policy assures that the automatic reboot feature is disabled.

NIST Windows XP - 8.2 Registry Values - Automatic Functions - Disable Automatically Running CD-ROMs

This policy assures that the automatic execution of CD-ROM content is disabled.

NIST Windows XP - 8.3 Registry Values - Networking - Harden the Microsoft TCPIP stack settings

This policy assures that the Microsoft TCP/IP stack settings are configured to be consistent with the NIST recommendations.

NIST Windows XP - 8.3 Registry Values - Networking - Strengthen miscellaneous networking settings

This policy assures that the networking settings are consistent with the NIST recommendations.

Top

NIST Windows 2000 Security Template Policies

NIST Windows 2000 Professional Gold Plus Standard Security Settings

This policy introduces the Windows 2000 Professional security baseline that is based on the recommendations made by a NIST, NSA, DISA, SANS, and CIS and reviewed by GSA.

NIST Windows 2000 Professional Gold Standard Security Settings

This policy introduces the Windows 2000 Professional security baseline that is based on the recommendations made by a NIST, NSA, DISA, SANS, and CIS and reviewed by GSA.

Top

NSA Security Template Policies

NSA Enhanced Security for Windows 2000 Server Domain Controllers

NSA Enhanced Security for Windows 2000 Domain Controllers.

NSA Enhanced Security for Windows 2000 Servers

NSA Enhanced Security for Windows 2000 Member/Stand-alone Servers.

NSA Enhanced Security for Windows 2000 Workstations

NSA Enhanced Security for Windows 2000 Member/Stand-alone Workstations.

NSA Enhanced Security for Windows XP Workstations

NSA Enhanced Security for Windows XP Member/Stand-alone Workstations.

Top

Microsoft Security Template Policies

Windows 2000 Professional: Baseline Security Settings

This policy provides settings to support the Evaluated Configuration of Windows 2000 under the Common Criteria (CC) for Information Technology Security Evaluation.

Windows 2000 Professional: High Security Settings

This policy provides settings for high security computers to support the Evaluated Configuration of Windows 2000 under the Common Criteria (CC) for Information Technology Security Evaluation.

Windows 2000 Server: Domain Controller

This Security Configuration Template provides settings to support the Windows 2000 Server domain-controller security settings for the Securing Windows 2000 Server Solution Guide.

Windows 2000 Server: File Server

This Security Configuration Template provides settings to support the Windows 2000 Server File-Server or Print-Server security settings for the Securing Windows 2000 Server Solution Guide.

Windows 2000 Server: IIS Server

This Security Configuration Template provides settings to support the Windows 2000 Server IIS Server security settings for the Securing Windows 2000 Server Solution Guide.

Windows 2000 Server: Infrastructure Server

This Security Configuration Template provides settings to support the Windows 2000 Server Infrastructure Server security settings for the Securing Windows 2000 Server Solution Guide.

Windows 2000 Server: Member Server

This Security Configuration Template provides settings to support the Windows 2000 Server base security settings for the Securing Windows 2000 Server Solution Guide.

Windows 2000 Server: Print Server

This Security Configuration Template provides settings to support the Windows 2000 Server File-Server or Print-Server security settings for the Securing Windows 2000 Server Solution Guide.

Windows Server 2003: Enterprise Client - Certificate Services

This policy provides incremental settings for a Certificate Services Server in an environment with only Windows 2000 or Windows XP clients.

Windows Server 2003: Enterprise Client - Domain Controller

This policy provides settings for a Domain Controller in an environment with only Windows 2000 or Windows XP clients.

Windows Server 2003: Enterprise Client - File Server

This policy provides incremental settings for a File Server in an environment with only Windows 2000 or Windows XP clients.

Windows Server 2003: Enterprise Client - IAS Server

This policy provides incremental settings for an IAS Server in an environment with only Windows 2000 or Windows XP clients.

Windows Server 2003: Enterprise Client - IIS Server

This policy provides incremental settings for an IIS Server in an environment with only Windows 2000 or Windows XP clients.

Windows Server 2003: Enterprise Client - Infrastructure Server

This policy provides incremental settings for an Infrastructure Server in an environment with only Windows 2000 or Windows XP clients.

Windows Server 2003: Enterprise Client - Member Server Baseline

This policy provides baseline settings for all Member Servers in an environment with only Windows 2000 or Windows XP clients.

Windows Server 2003: Enterprise Client - Print Server

This policy provides incremental settings for a Print Server in an environment with only Windows 2000 or Windows XP clients.

Windows Server 2003: High Security - Bastion Host

This policy provides settings for a Bastion Host server.

Windows Server 2003: High Security - Domain Controller

This policy provides settings for a Domain Controller in an environment with high security requirements.

Windows Server 2003: High Security - File Server

This policy provides incremental settings for a File Server in an environment with high security requirements.

Windows Server 2003: High Security - IIS Server

This policy provides incremental settings for an IIS Server in an environment with high security requirements.

Windows Server 2003: High Security - Infrastructure Server

This policy provides incremental settings for an Infrastructure Server in an environment with high security requirements.

Windows Server 2003: High Security - Member Server Baseline

This policy provides baseline settings for all Member Servers in an environment with high security requirements.

Windows Server 2003: High Security - Print Server

This policy provides incremental settings for a Print Server in an environment with high security requirements.

Windows Server 2003: Legacy Client - Domain Controller

This policy provides settings for a Domain Controller in an environment with legacy clients.

Windows Server 2003: Legacy Client - File Server

This policy provides incremental settings for a File Server in an environment with legacy clients.

Windows Server 2003: Legacy Client - IIS Server

This policy provides incremental settings for an IIS Server in an environment with legacy clients.

Windows Server 2003: Legacy Client - Infrastructure Server

This policy provides incremental settings for an Infrastructure Server in an environment with legacy clients.

Windows Server 2003: Legacy Client - Member Server Baseline

This policy provides baseline settings for all Member Servers in an environment with legacy clients.

Windows Server 2003: Legacy Client - Print Server

This policy provides incremental settings for a Print Server in an environment with legacy clients.

Windows XP: Enterprise Client - Desktop Computer

Enterprise client settings for Windows XP desktop computers.

Windows XP: Enterprise Client- Laptop Computer

Enterprise client settings for Windows XP laptop computers.

Windows XP: High Security - Desktop Computer

High Security Settings for Windows XP desktop computers.

Windows XP: High Security - Laptop Computer

High security settings for Windows XP laptop computers.

Top

PCI Compliance Solution Policy Commander Software Menu

Securing Cardholder Information – and Your Business

Payment card processing comes with a cost, and adds one more layer of complexity to your overall compliance efforts. Under the Payment Card Industry (PCI) Data Security Standard you have to prove that the security of your cardholder information measures up to the requirements set down by Visa.

The PCI Standard, created to enforce industry requirements for payment card information security, covers all organizations that transact business via payment cards or process those transactions. And it adds one more layer of complexity to your overall regulatory compliance efforts.

The New Boundary Technologies PCI Compliance Solution powered by Policy Commander™ simplifies compliance with PCI Standard requirements. It dramatically cuts the risk of security breaches and information theft. And it shows to auditors that you have real-time, continuous monitoring and enforcement of highly secure computer configurations and settings.

Our PCI Compliance solution lays out the IT requirements from the PCI Data Security Standard to help you identify the areas of your infrastructure that will be involved in the process and plan for implementation. Then it provides a full library of proven workstation and server policies that help you build your security baseline. Finally, Policy Commander helps you customize policies to your environment with an integrated Policy Editor. It assigns the correct security policies to each computer. It monitors and enforces those policies 24/7. And it even remediates computers that go out of compliance with any policies. All automatically.'

Our PCI Compliance Solution gives you the power to create a self-monitoring and self-healing security environment inside the firewall, where the majority of your vulnerabilities and threats exist. It ensures and demonstrates in real-time that your computers comply with critical PCI security requirements. It delivers both high-level and granular views of security compliance. And it protects information even when computers are disconnected from the network. So if your business depends on payment card transactions, you need the PCI Compliance Solution powered by Policy Commander™.

Download the PCI Compliance Guide                                                                                        

XP Lockdown Guide Policy Commander Software Menu

New Boundary Technologies developed this guide to provide insight and recommended security configurations for security officers and network administrators charged with locking down their Windows XP workstations.  System lockdown is not a new concept.  Advice regarding best practices is available from many experts, and security templates are available from organizations such as the National Institute of Standards and Technology (NIST).  However, actually implementing these best practices and security templates has always been a time-consuming and manual process because of the wide variety of PC configurations and end user applications involved.

New Boundary Technologies offers a solution that addresses this implementation problem.  Our XP lockdown guide offers advice about best practices then goes a step further to explain how administrators can manage specific policies within our Policy Commander application to lock down XP workstations based on virtually any configuration trait, from operating system and service pack level to Windows services and even specific registry settings.  For the first time, network and desktop administrators now have an automated solution that empowers them to quickly and easily implement security best practices for Windows XP via security policy enforcement and dynamic configuration management.

Download the XP Lockdown Guide