# $ K File Systems
Required for C2 Level Security
Under Windows NT, only the NT File System (NTFS) supports Discretionary Access Control to the files and directories. Consequently, only NTFS volumes are allowed on the system to provide secure and auditable access to the files. FAT volumes do not provide the necessary security functions to support C2 Level security.

File Systems Dialog

# $ K OS Configuration
Required for C2 Level Security
Allowing other operating systems, such as MS-DOS to run on a secure system, can allow users to circumvent Windows NT security. For a system to support C2 level security, Windows NT must be the only operating system on the computer.

Operating Systems Dialog

# $ K OS/2 Subsystem
Required for C2 Level Security
The OS/2 subsystem was not included in the current NCSC C2 evaluated configuration. For your system to conform to the evaluated configuration, the OS/2 system must be disabled. The C2Configuration manager disables the OS/2 subsystem by deleting the following files from the SYSTEM32 directory under the systemroot:

	OS2.EXE
	OS2SS.EXE

To restore the OS/2 subsystem to your computer, these files must be copied from the CD or Floppy disk to the SYSTEM32 directory under the system root using the copy or expand command.

# $ K Posix Subsystem
Required for C2 Level Security
The Posix subsystem was not included in the current NCSC C2 evaluated configuration. For your system to conform to the evaluated configuration, the Posix system must be disabled. The C2Configuration manager disables the Posix subsystem by deleting the following file from the SYSTEM32 directory under the systemroot:

	PSXSS.EXE

To restore the Posix subsystem to your computer, this file must be copied from the CD or Floppy disk to the SYSTEM32 directory under the system root using the copy or expand command.

# $ K Security Log
Required for C2 Level Security

C2 Level security requires that a security audit log be maintained and events in the log may not be automatically overwritten. For systems that do not require C2 Level security, other logging options may be selected such as to overwrite events that are older than a certain age, or when the log is full.

Security Log Settings Dialog 

# $ K Halt on Audit Failure
If the security log is full, it becomes possible for some events to not get logged. Selecting this option will halt the computer when the log is full to prevent losing any events. If the system halts as a result of a full log, an administrator must restart the system and reset the log.

Audit Failure Settings Dialog 

# $ K Display Logon Message
On a secured system, a warning message may be displayed before the user is allowed to log on. Typically this message will  inform the user that the system is for authorized users only and that unauthorized is considered trespass or is unwelcome.

On the other hand, if the system is in use in a public forum, this message may be used to inform the user of current events or how to log on to the system.

Logon Message Dialog 

# $ K Last Username Display
Displaying the name of the last user can make logging in more convenient, however, hiding the name of the last user can prevent usernames from being accidentally discovered and subsequently used to break in to the system. This option allows the last username to be hidden when the logon screen is displayed.

Last Username Display Dialog 

# $ K Shutdown Button
Hiding the “Shutdown” button from the logon screen prevents users from shutting the system down without first logging on to the computer. This option should only be selected if the power switch and reset button is not accessible by the user. Even though the shutdown button may be hidden, if the user has access to either the reset button or the power switch, they may still turn the system off without properly shutting down the operating system.

Shutdown Button Dialog 

# $ K Password Length
Required for C2 Level Security
The longer the password, the less likely it will be discovered randomly, or deliberately by an intruder. C2 Level Security does not allow Blank Passwords. Using this item, the desired password policy can be selected. 

NOTE: Changing this setting will not affect passwords already defined in the system.

Password Length Dialog 

# $ K Guest Account
Required for C2 Level Security
The Guest account allows anonymous and therefore unauditable access to the system and its files. C2 Level security does not allow for anonymous access to the system and therefore requires that Guest accounts be disabled or deleted from the system. When this item is selected, the C2 Configuration manager disables all Guest accounts.

Guest Account Dialog 

# $ K Networking
Required for C2 Level Security
Windows NT networking services were not included in the NCSC C2 evaluated configuration. For your system to conform to the evaluated configuration, the network services must be removed or disabled.

# $ K Drive Letters & Printers
To prevent redirection of data to a device or port that may not be authorized, the assignment of drive letters and printer ports can be restricted to administrators only.

Drives and Printers Dialog 

# $ K Removable Media Drives
Since Windows NT is a multi-user system and programs run by other users may be running in the background while a user is logged on. It is possible to prevent programs run by other users from accessing disks in removable media drives that may have been inserted while a user is logged on by allocating these drives automatically when a user logs on.

Allocate Removable Drives 

# $ K Other Security Items
C2Config is not able to detect nor set all aspects of a Windows NT system in order to make it conform to C2 Level Security. This dialog lists the items that C2Config is not able to detect and set and provides references to where additional information may be found on thc configuration of these items.
Power On Password 
Secure System Partition 
Change User Manager Program Item 
Restrict Use of User Rights 

# $ K Power On Password
The Power On password requires the user to enter a password before the system starts. Refer to the computer system’s documentation for information on setting the system’s power-on password.

# $ K Secure System Partition
On a RISC computer, start Disk Administrator and select Secure System Partition from the Partition Menu. This ensures that only users logged on as members of the Administrators group can access files on the system partition.

Note: this is only required on RISC computer systems.

# $ K Change User Manager Program Icon
If you are setting up Windows NT Server, remove the User Manager For Domains program item and add the User Manager program item as described in the “Program Manager” chapter of the Windows NT Workstation or Windows NT Server System Guide. The name of the executable file for User Manager is MUSRMGR.EXE.

# $ K Restrict Use of User Rights
This is managed and configured by the User Manager program and is described in the “User Manager” chapter of the Windows NT Workstation or Windows NT Server System Guide. Rights should be limited as described in the Windows NT C2 Security System Administrator’s Guide.

# $ K File System Dialog
Required for C2 Level Security

The status of the disk volumes on the system is displayed in the list box. For Windows NT to support C2 Level security all disk volumes must use the NTFS file system. 
To convert a volume to the NTFS file system, select the volume in the list box (multiple volumes can be selected by holding the shift key while selecting). 
Selecting the C2 button will select all non-NTFS volumes for conversion.

NOTE: selecting a non-NTFS disk for conversion will NOT convert the disk immediately, rather it will schedule the disk for conversion the next time the system is shutdown and restarted.

# $ K Operating System Dialog
Required for C2 Level Security

The non-Windows NT operating systems are listed in the list box. Selecting items displayed in the list box will cause the C2 Configuration Manager to change that item to the value that supports C2 Level Security. 
Selecting the C2 button will select all items in the list box.

The changes selected in this list box are made immediately after the OK button is selected, however they will not take effect until the system is restarted.

# $ K Security Log Settings Dialog
Required for C2 Level Security
The characteristics of the security log can be set in this dialog. The options available are:
Overwrite Events As Needed which will overwrite the oldest events in the log once the log is full.
Overwrite Events Older than ____ days will overwrite events that are older the specified age regardless of how full the log is.
Do Not Overwrite Events (Clear Log Manually) will prevent the log from automatically destroying any logged events. The administrator must manually reset the log. This option must be selected for C2 compliance.
Selecting the C2 button will select the Do Not Overwrite Events (Clear Log Manually) button.

Changes made in this dialog are made immediately after the OK button has been selected.

# $ K Audit Failure Settings Dialog
Selecting the check box will configure the system to halt when the security log is filled. This setting prevents security events from occurring without an audit trail of them. 
Selecting the Secure button will select the check box.

Changes made in this dialog are made immediately after the OK button has been selected, however they will not take effect until the system is restarted.

# $ K Logon Message Dialog
The caption and text of a message box that is displayed prior to logon may be entered in the edit boxes contained in this display. The check box must be unchecked before the edit boxes are enabled.
Selecting the Secure button will uncheck the check box and enable the edit boxes. You must then provide the caption and message text before exiting the dialog.

Changes made in this dialog are made immediately after the OK button has been selected.

# $ K Last Username Display Dialog
Checking the check box will prevent the last username from being displayed in the logon dialog box.
Selecting the Secure button will check the check box.

Changes made in this dialog are made immediately after the OK button has been selected.

# $ K Shutdown Button Dialog
Checking the check box will prevent the Shutdown button from being displayed in the logon dialog box. This will require the user to logon before being able to shutdown Windows NT.
Selecting the Secure button will check the check box.

Changes made in this dialog are made immediately after the OK button has been selected.

# $ K Password Length Dialog
Required for C2 Level Security

The minimum password length for all new accounts and passwords may be specified in this dialog. The top radio button will allow blank passwords, while the bottom radio button will specify a minimum password length.
Selecting the C2 button will require a minimum password length of 6 characters, however to support C2 Level Security, this value can be as small as 1.

Changes made in this dialog are made immediately after the OK button has been selected.

# $ K Guest Account Dialog
Required for C2 Level Security
Checking the check box, will prevent users from logging on using the Guest account.
Selecting the C2 button will disable the Guest account.

Changes made in this dialog are made immediately after the OK button has been selected.

# $ K Drives and Printers Dialog
Checking the check box will allow only administrators to assign drive letters and printers.
Selecting the Secure button will check the check box

Changes made in this dialog are made immediately after the OK button has been selected, however they will not take effect until the system is restarted.

# $ K Allocate Removable Drives Dialog
Checking one or both of the check boxes will prevent access to the specified devices by programs started by another user while a user is logged on by allocating those drives when the user logs on.
Selecting the Secure button will check both check boxes prohibiting access to both the floppy drives and the CD-ROM Drives by programs run by another user.

Changes made in this dialog are made immediately after the OK button has been selected, however they will not take effect until the system is restarted.