Hardened UNC Paths and why
đź’ˇ
Note; If the environment exclusively contains Windows 8.0 / Server 2012 (non-R2) or newer systems, then the 'Privacy' setting may (optionally) also be set to enable SMB encryption. However, using SMB encryption will render the targeted share paths completely inaccessible by older OSes, so only use this additional option with caution and thorough testing.
Why Harden UNC Paths in Windows Active Directory?
Hardening UNC (Universal Naming Convention) paths in Windows Active Directory is crucial for enhancing security and protecting sensitive data. UNC paths are used to identify and access network resources such as shared folders, printers, and other services1. By default, these paths are susceptible to various security threats, including man-in-the-middle attacks, credential theft, and unauthorized access2.
Key Benefits of Hardening UNC Paths:
- Mutual Authentication: Hardened UNC paths enforce mutual authentication between the client and the server, ensuring that both parties verify each other's identity before establishing a connection2. This prevents unauthorized access and protects against impersonation attacks2.
- Integrity Protection: By requiring integrity checks, hardened UNC paths ensure that data transmitted between the client and the server remains unaltered during transit2. This helps detect and prevent tampering or data corruption.
- Enhanced Security Policies: Hardened UNC paths allow administrators to define specific security policies for critical network shares, such as SYSVOL and NETLOGON2. These policies can include encryption, access controls, and logging to monitor and audit access attempts.
- Compliance with Security Standards: Implementing hardened UNC paths helps organizations comply with industry security standards and best practices, such as the Security Technical Implementation Guides (STIGs) and the National Institute of Standards and Technology (NIST) guidelines.
How to Harden UNC Paths:
To harden UNC paths in Windows Active Directory, follow these steps:
- Open the Group Policy Management Console (GPMC).
- Create a new Group Policy Object (GPO) or edit an existing one.
- Navigate to Computer Configuration > Policies > Administrative Templates > Network > Network Provider.
- Double-click on Hardened UNC Paths and select Enabled.
- And specify the following
Value Name: \\*\NETLOGON
Value: RequireMutualAuthentication=1, RequireIntegrity=1
Value Name: \\*\SYSVOL
Value: RequireMutualAuthentication=1, RequireIntegrity=1