GPO_name\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Default values Use caution when implementing this countermeasure in your environment. For some organizations, this downtime violates their internal service level agreements. For a server with 2 gigabytes (GB) of RAM and a 2-GB paging file, this setting can add more than 30 minutes to the shutdown process. This delay in shutting down the server is especially noticeable on servers with large paging files. Depending on the size of the paging file, this process might take several minutes before the system completely shuts down. This causes the Windows Server operating system to clear the paging file when the system is shut down. Also, this policy setting forces the computer to clear the hibernation file (hiberfil.sys) when hibernation is disabled on a portable computer. The system paging file is cleared when the system shuts down normally. A malicious user who has physical access to the server can bypass this countermeasure by simply unplugging the server from its power source. This is a time-consuming process, but it can expose data that is cached from RAM to the paging file. The attacker can move the system volume into a different computer and then analyze the contents of the paging file. A malicious user who has physical access to a server that has been shut down can view the contents of the paging file. This helps computers running at least the Windows Server 2003 operating system handle multitasking functions. Important information that is kept in real memory might be written periodically to the paging file. This confirmation ensures that sensitive information from process memory that might be placed in the paging file is not available to an unauthorized user who manages to directly access the paging file after shutdown.
However, computers that are configured to allow other operating systems to start should verify that the system paging file is cleared as the computer shuts down. On a running computer, this paging file is opened exclusively by the operating system, and it is well protected.
Virtual memory support uses a system paging file to swap pages of memory to disk when they are not used. This policy setting determines whether the virtual memory paging file is cleared when the computer is shut down. This security policy reference topic for the IT professional describes the best practices, location, values, policy management and security considerations for this policy setting. Applies To: Windows Server 2003, Windows Vista, Windows XP, Windows Server 2008, Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2012, Windows 8
0 kommentar(er)
