Revision as of 12:17, 22 November 2006

Tasks

Use WMI filters to block incompatible GPOs. Todo:

Default Domain Policy - Still deciding how to handle GP differences between WinXP and Vista.
Domain-Laptop Policy - Still deciding how to handle GP differences between WinXP and Vista.
FW-NCSU-WolfTech-Defrag C-1.0-20050408 - Not necessary, Vista has builtin defrag scheduling.
SW-NCSU-NCSU-Wolfcall (with autologin)-1.2.0-20040601 - Not Vista compatible.
SW-NCSU-NCSU-Wolfcall (with autologin)-1.2.1-20050510 - Not Vista compatible.
SW-NCSU-NCSU-Wolfcall (with autologin)-1.2.1-20060829 - Not Vista compatible.
SW-NCSU-NCSU-Wolfcall (without autologin)-1.2.1-20050615 - Not Vista compatible.
SW-NCSU-Symantec-AntiVirus (UNI03NT)-10.0.2.2021-20060530 - Not Vista compatible.
SW-ECE-Symantec-AntiVirus (SERPENT)-10.0.2.2021-20060530 - Not Vista compatible.

Options:

Create separate domain policies for Vista and Windows 2000/XP/2003.
- Creates more complexity by having completely separate group policy environments for different OS's.
- OS's may have different security levels/inconsistent security policies.
  - Reduces predictability.
  - Complicates determining security compliance.
  - Compatibility issues could vary on different OS's
Use common domain policy for all OS's and create a separate domain policy for Vista only policies.
- This would prevent any unintended consequences on XP/2003 computers.
- Reduces complexity by having common security policies for all OS's.
- Would be a good idea to reconsider settings using both updated Windows XP Security Guide and new Windows Vista Security Guide.
Use common domain policy for all OS's including Vista only policies.
- Will require testing to make sure Vista only policies don't cause problems on XP/2003 computers.
- Reduces complexity by having common security policies for all OS's.
- Would be a good idea to reconsider settings using both updated Windows XP Security Guide and new Windows Vista Security Guide.

Observations:

Security settings in Vista and Windows XP are very similar. The only obvious difference is that Vista has new policies to control new features such as privilege elevation.

Todo:

Todo:

@@ Line 15: / Line 15: @@
 ===Domain Policy===
+Options:
+*Create separate domain policies for Vista and Windows 2000/XP/2003.
+**Creates more complexity by having completely separate group policy environments for different OS's.
+**OS's may have different security levels/inconsistent security policies.
+***Reduces predictability.
+***Complicates determining security compliance.
+***Compatibility issues could vary on different OS's
+*Use common domain policy for all OS's and create a separate domain policy for Vista only policies.
+**This would prevent any unintended consequences on XP/2003 computers.
+**Reduces complexity by having common security policies for all OS's.
+**Would be a good idea to reconsider settings using both updated Windows XP Security Guide and new Windows Vista Security Guide.
+*Use common domain policy for all OS's including Vista only policies.
+**Will require testing to make sure Vista only policies don't cause problems on XP/2003 computers.
+**Reduces complexity by having common security policies for all OS's.
+**Would be a good idea to reconsider settings using both updated Windows XP Security Guide and new Windows Vista Security Guide.
+Observations:
+*Security settings in Vista and Windows XP are very similar.  The only obvious difference is that Vista has new policies to control new features such as privilege elevation.
 ==Test Software==
 ===Compatible===