Best Practices

Best Practices

• Use templates properly.

  Never edit the built-in security templates, especially templates such as Setup Security.inf, which gives you the option to reapply the default security settings. Instead of just modifying a predefined template, customize the predefined template and then save the changes under a different template name.

• Monitor the size of security templates when using Group Policy.

  Security templates can become very large if many settings are made. For example, the Setup Security.inf template is 770 KB. Security templates this large could cause network performance degradation when applied by using Group Policy.

• Create templates for specific computer roles.

  Because security templates are easy to create and customize, they can easily be created to fit the security requirements of computers in different roles. For example, your Web server might have different security requirements than a domain controller.

• Test security templates.

  Always test security templates in a nonproduction environment to ensure that the settings do not prevent legitimate uses of the computer. Furthermore, it is possible to prevent all accounts from accessing a computer using settings in security templates.