Hive: HKEY_LOCAL_MACHINEKey: SYSTEM\CurrentControlSet\Control\LsaName: SubmitControlType: REG_DWORDValue: 1 On a Domain Controller, the server operator accounts must be added to the Server Operators group. On a member server or a stand-alone server, they must be added to the local Administrators group. There …
You can control whether Explorer will restore windows which were open when NT was shutdown. This automatic restoring of windows drives me nuts. It was a problem in OS/2, Windows NT, and now Windows 2000. You don’t like it, fix …
Prevent open or minimized applications from restarting at reboot Read More »
One can restrict the programs that a user can run by setting the RestrictRun which will restrict the user to programs in the Explorer\Restrict subkey. Apply the following Windows NT / Windows 2000 registry hack: Hive: HKEY_CURRENT_USERKey: Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerName: RestrictRunType: REG_DWORDValue: …
Restrict programs that can be run in Windows NT / Windows 2000 Read More »
By default, guests and unauthorized users can read the System and Application event logs (not the Security log). To restrict to authenicated users: Hive: HKEY_LOCAL_MACHINEKey: SYSTEM\CurrentControlSet\Services\EventLog\ApplicationName: RestrictGuestAccessType: REG_DWORDValue: 1 Restrict access to Application log Hive: HKEY_LOCAL_MACHINEKey: SYSTEM\CurrentControlSet\Services\EventLog\SystemName: RestrictGuestAccessType: REG_DWORDValue: 1 …
Restrict access to Application and System event logs Read More »
To change location of the Windows NT or Windows 2000 Security event log you can use the Event Viewer to indirectly modify the registry or to apply the registry hack directly: Hive: HKEY_LOCAL_MACHINEKey: SYSTEM\CurrentControlSet\Services\EventLog\SecurityName: FileType: REG_EXAND_SZValue: %SystemRoot%\system32\config\SecEvent.Evt default Appication and …
Red Button access attack uses Anonymous User Connections , also called Null User Connection, to discover which account is the administrative account and what the network shares are. You can disable this discovery by preventing anonymous connections to domains using …
NT4 copies the Win95 feature of using animated rectangles to provide a “zooming” effect when windows are opened and closed. To control Hive: HKEY_CURRENT_USERKey: Control Panel\Desktop\WindowMetricsName: MinAnimateType: REG_DWORDValue: 0 disableValue: 1 enable See q226931 – How to Minimize Graphics Use …
You can control what appears during Windows NT security dialog box using the following Windows NT registry hack: Disable Lock Workstation button:Hive: HKEY_CURRENT_USERKey: Software\Microsoft\Windows\CurrentVersion\Policies\System Name: DisableLockWorkstation Type: REG_DWORDValue: 1 disable Disable Task Manager button: Hive: HKEY_CURRENT_USERKey: Software\Microsoft\Windows\CurrentVersion\Policies\System Name: DisableTaskMgrType: REG_DWORDValue: …
The system automatically creates hidden “administrative shares” for its logical drives C:, D:, and so forth which it names C$, D$ and so forth. It also creates the admin$ hidden share for to the \winnt folder. These shares are designed …
Write debugging data to a memory dump file during a crash. This will dump a memory image which means you need at least as much free disk space as there is RAM. Hive: HKEY_LOCAL_MACHINEKey: \SYSTEM\CurrentControlSet\ControlName: CrashDumpEnabledType: REG_DWORDValue: 0 no dump …
Windows NT / Windows 2000 Crash Dump, Event Logging, Admin Alerts Enabled Read More »
