Using the Security Configuration Wizard with Microsoft Forefront Threat Management Gateway 2010

[LEFT][CODE]http://www.isaserver.org/tutorials/Using-Security-Configuration-Wizard-Microsoft-Forefront-Threat-Management-Gateway-2010.html[/CODE]

[IMG]http://www.isaserver.org/img/upl/richard_hicks1262958081097.jpg[/IMG]
[B][B]Richard Hicks[/B][/B]

[B]Introduction[/B]

Windows Server 2008 and 2008R2 include a valuable tool called the Security Configuration Wizard (SCW). This tool can be used to simplify the task of hardening the base operating system in preparation for deploying a Forefront Threat Management Gateway (TMG) 2010 firewall. The SCW will create a policy that configures services, audit policies, and some registry settings based on the roles and features installed. In this article I will demonstrate how to use the SCW to configure and install a security policy on a TMG firewall system, and how to deploy this security policy using Active Directory Group Policy.
[B]Forefront TMG Roles for SCW[/B]

By default, the SCW does not include support for the TMG 2010 role or the TMG Enterprise Management Server (EMS) role. To support these roles, download and install [B]TMGRolesForSCW.exe[/B] included in the TMG 2010 Tools and Software Development Kit (SDK), available [URL="http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=8809cfda-2ee1-4e67-b993-6f9a20e08607"]here[/URL].
[B]Installing TMG Roles for SCW[/B]

To install the TMG roles for SCW, run the executable [B]TMGRolesForSCW.exe[/B].
[IMG]http://www.isaserver.org/img/upl/image0021264798628577.jpg[/IMG]
[B]Figure 1[/B]
Accept the terms of the license agreement.
[IMG]http://www.isaserver.org/img/upl/image0041264798628608.jpg[/IMG]
[B]Figure 2[/B]
Choose a location to save the files.
[IMG]http://www.isaserver.org/img/upl/image0061264798628608.jpg[/IMG]
[B]Figure 3[/B]
Choose [B]Finish[/B] to complete the installation of the Forefront TMG Roles for SCW.
[IMG]http://www.isaserver.org/img/upl/image0081264798628624.jpg[/IMG]
[B]Figure 4[/B]
After completing the installation, the next step is to register these new roles with the SCW. To register these roles, navigate to the folder you chose to save the files to earlier and copy one of the following files to[B] %systemroot%\security\msscw\kbs[/B]:

[LIST][*] For TMG on Windows Server 2008 SP2, copy scw_tmg_w2k8_sp2.xml[*] For TMG on Windows Server 2008 R2, copy scw_tmg_w2k8r2_sp0.xml[*] For TMG EMS on Windows Server 2008 SP2, copy scw_tmgems_w2k8_sp2.xml[*] For TMG EMS on Windows Server 2008 R2, copy scw_tmgems_w2k8r2_sp0.xml[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0101264798865452.jpg[/IMG]
Figure 5[/B]
Open an elevated command prompt and navigate to the [B]%systemroot%\security\msscw\kbs[/B] folder, then type one of the following commands:

[LIST][*] For TMG on Windows Server 2008 SP2:
[B]scwcmd register /kbname:TMG /kbfile:scw_tmg_w2k8_sp2.xml[/B][*] For TMG EMS on Windows Server 2008 SP2:
[B]scwcmd register /kbname:TMG /kbfile:scw_tmgems_w2k8_sp2.xml[/B][*] For TMG on Windows Server 2008 R2:
[B]scwcmd register /kbname:TMG /kbfile:scw_tmg_w2k8r2_sp0.xml[/B][*] For TMG EMS on Windows Server 2008 R2:
[B]scwcmd register /kbname:TMG /kbfile:scw_tmgems_w2k8r2_sp0.xml[/B][/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0121264798865452.jpg[/IMG]
[/B][B]Figure 6[/B]
[B]Creating a Security Policy using SCW[/B]

Open the SCW by selecting [B]Start/Administrative Tools[/B] and clicking the [B]Security Configuration Wizard[/B] icon.
[IMG]http://www.isaserver.org/img/upl/image0141264798865467.jpg[/IMG]
[B]Figure 7[/B]
Select the action you wish to perform. For our purposes here we’ll select the option to [B]Create a new security policy[/B]. Once we’ve finished creating a policy we can later edit, apply, or roll back the policy if necessary.
[IMG]http://www.isaserver.org/img/upl/image0161264798865467.jpg[/IMG]
[B]Figure 8[/B]
The SCW can be used on a local or remote machine. We’re going to configure the policy for the local machine, for which the host name is pre-populated.
[IMG]http://www.isaserver.org/img/upl/image0181264798947170.jpg[/IMG]
[B]Figure 9[/B]
The SCW will begin processing the Security Configuration Database.
[IMG]http://www.isaserver.org/img/upl/image0201264798947170.jpg[/IMG]
[B]Figure 10[/B]
Once complete, click the [B]View Configuration Database[/B] to confirm that the Forefront Threat Management Gateway server role is included in the database.
[IMG]http://www.isaserver.org/img/upl/image0221264798947186.jpg[/IMG]
[B]Figure 11[/B]
[B]Note:[/B]You may receive the following Windows Security Warning. Click [B]Yes[/B] to view the configuration database.
[IMG]http://www.isaserver.org/img/upl/image0241264798947186.jpg[/IMG]
[B]Figure 12[/B]
Click the arrow to expand [B]Server Roles[/B] and confirm that [B]Microsoft Forefront Threat Management Gateway (TMG)[/B] appears in the list. Once complete, close this window to return to the SCW.
[IMG]http://www.isaserver.org/img/upl/image0261264799028811.jpg[/IMG]
[B]Figure 13[/B]
[B]Roles, Features, Options, and Services[/B]

The SCW will now begin role-based service configuration.
[IMG]http://www.isaserver.org/img/upl/image0281264799028811.jpg[/IMG]
[B]Figure 14[/B]
The SCW will configure a security policy based on the roles and features installed on the system. Several installed roles are selected by default. Click the arrow next to any role for additional information about that role. Confirm any roles selected, and then select the [B]Microsoft Forefront Threat Management Gateway (TMG) role. [/B]If your TMG firewall is also providing VPN services, be sure to select the [B]Remote access/VPN server[/B] role.
[IMG]http://www.isaserver.org/img/upl/image0301264799028811.jpg[/IMG]
[B]Figure 15[/B]
Several installed features are selected by default. Review the selected choices and make adjustments as required. For example, you may choose to disable the [B]Microsoft Networking Client[/B] or enable the [B]WINS client[/B], depending on your specific security requirements.
[IMG]http://www.isaserver.org/img/upl/image0321264799028827.jpg[/IMG]
[B]Figure 16[/B]
Several installed options are selected by default. Once again, review the selected choices and make adjustments as necessary. Review the list carefully as the defaults include features that are not frequently used (e.g. [B]Microsoft Fibre Channel Platform Registration Service[/B]). Note that if you want to connect to your TMG firewall using Remote Desktop Services (RDP), be sure to select the [B]Remote Desktop[/B] role (it is not selected by default).
[IMG]http://www.isaserver.org/img/upl/image0341264799121592.jpg[/IMG]
[B]Figure 17[/B]
Review the list of additional services and make adjustments as required. Services listed here that are checked will be enabled; all other services will be disabled.
[IMG]http://www.isaserver.org/img/upl/image0361264799121608.jpg[/IMG]
[B]Figure 18[/B]
Define how the SCW will handle any unspecified services which are running on the selected system and were not included in the security configuration database. Select the option that best meets your requirements. Choose carefully, as selecting the option to disable services could have unintended consequences.
[IMG]http://www.isaserver.org/img/upl/image0381264799121608.jpg[/IMG]
[B]Figure 19[/B]
Review the list of changes made to services on the system. If you selected the option to disable unspecified services, be sure to examine this list carefully. Pay close attention to any service that the policy will disable whose current startup mode is automatic. You can sort this list by [B]Current Startup Mode[/B] by clicking on the column header.
[IMG]http://www.isaserver.org/img/upl/image0401264799121608.jpg[/IMG]
[B]Figure 20[/B]
[B]Network Security[/B]

In this section the SCW will configure network security settings.
[IMG]http://www.isaserver.org/img/upl/image0421264799201889.jpg[/IMG]
[B]Figure 21[/B]
The SCW will configure key registry settings that control protocols used to communicate with other computers. Proceed cautiously, as choosing incorrect settings can have unintended consequences. If you are unsure which options to select, you can safely skip this section.
[IMG]http://www.isaserver.org/img/upl/image0441264799201905.jpg[/IMG]
[B]Figure 22[/B]
By default, the SCW makes assumptions about client operating systems and utilization on the TMG system. Review these options and confirm that they meet your requirements.
[IMG]http://www.isaserver.org/img/upl/image0461264799201905.jpg[/IMG]
[B]Figure 23[/B]
Select the outbound authentication method that meets your requirements.
[IMG]http://www.isaserver.org/img/upl/image0481264799201905.jpg[/IMG]
[B]Figure 24[/B]
When using domain accounts (highly recommended) confirm that all other computers with which the TMG system will communicate with are running a minimum of Windows NT 4.0 SP6A. If your clients synchronize their system clocks with this TMG system, you can select that option here. This option is not enabled by default, as most systems synchronize system time with an Active Directory domain controller.
[IMG]http://www.isaserver.org/img/upl/image0501264799300592.jpg[/IMG]
[B]Figure 25[/B]
Review the registry settings changes.
[IMG]http://www.isaserver.org/img/upl/image0521264799300608.jpg[/IMG]
[B]Figure 26[/B]
[B]Audit Policy[/B]

In this section the SCW will configure audit policy. If your audit policy is already configured to meet your requirements, you can safely skip this section.
[IMG]http://www.isaserver.org/img/upl/image0541264799300608.jpg[/IMG]
[B]Figure 27[/B]
Select an auditing option that meets your requirements.
[IMG]http://www.isaserver.org/img/upl/image0561264799300608.jpg[/IMG]
[B]Figure 28[/B]
Review the audit policy changes. Note that the option to include the [B]SCWaudit.inf[/B] security template is enabled by default. This security template will set System Access Control Lists (SACLS) to facilitate file system access auditing. Proceed cautiously, as once [B]SCWaudit.inf[/B] is applied it cannot be removed utilizing the SCW rollback option.
[IMG]http://www.isaserver.org/img/upl/image0581264799413295.jpg[/IMG]
[B]Figure 29[/B]
[B]Saving the Security Policy[/B]

Next, we will save the security policy.
[IMG]http://www.isaserver.org/img/upl/image0601264799413327.jpg[/IMG]
[B]Figure 30[/B]
Specify a location to save the policy file and include a description (optional but recommended). You may also view the security policy or include additional security templates.
[IMG]http://www.isaserver.org/img/upl/image0621264799413358.jpg[/IMG]
[B]Figure 31[/B]
If you are configuring a single system you can choose the option to apply the security policy immediately. If you have multiple TMG firewalls, a better choice is to deploy the security policy using Active Directory Group Policy. The next section demonstrates how that is accomplished.
[IMG]http://www.isaserver.org/img/upl/image0641264799413358.jpg[/IMG]
[B]Figure 32[/B]
Finished!
[IMG]http://www.isaserver.org/img/upl/image0661264799490077.jpg[/IMG]
[B]Figure 33[/B]
[B]Deploying with Group Policy[/B]

One of the many advantages to deploying TMG as a domain member is the ability to manage security configuration using Group Policy. The SCW, however, is designed to configure and deploy a security policy to only one machine at a time (local or remote). Using the SCW command line tool [B]scwcmd.exe [/B]we can convert this security policy to a Group Policy Object (GPO), and then deploy the policy to multiple machines using Active Directory Group Policy. The syntax for this command is:
[B]scwcmd transform /p: [I]PathandPolciyFileName[/I] /g: [I]GPODisplayName[/I][/B]
[I]PathAndPolicyName[/I] is the policy created earlier, and [I]GPODisplayName[/I] is the name of the Group Policy Object (GPO) as it will appear in the Group Policy Management Console (GPMC).
Following our example, open an elevated command prompt and execute the following command:
[B]scwcmd transform /p:tmg_default.xml /g:”TMG Default”[/B]
[B][IMG]http://www.isaserver.org/img/upl/image0681264799490077.jpg[/IMG]
[/B][B]Figure 34[/B]
Once the command has completed successfully, open the GMPC ([B]Start/Administrative Tools/Group Policy Management[/B]) and expand the [B]Domains[/B] node. Expand the domain that the TMG firewall is a member of, and then expand [B]Group Policy Objects[/B]. There you will see the new Group Policy object created using the [B]scwcmd[/B] tool.
[IMG]http://www.isaserver.org/img/upl/image0701264799490092.jpg[/IMG]
[B]Figure 35[/B]
You can now apply this GPO to the Organizational Unit (OU) that includes your TMG firewalls. Ideally this will be a separate OU exclusively for your TMG systems to minimize any potential conflicts that might arise from the application of other GPOs. To apply the GPO, simply highlight and drag the GPO to the appropriate OU.
[B]Summary[/B]

Proper operating system configuration, service hardening and attack surface reduction are essential to the security and performance of the TMG firewall. Using the Security Configuration Wizard simplifies and automates this task, allowing the administrator to define security policies and apply them in a consistent manner using the SCW or Group Policy
[/LEFT]