No user profile required

Risk Level: Low risk vulnerability  Low

Check or Attack Name: No User Profile

Platforms: Windows NT
Description:

No user profile is required for the user. The System Policy Editor creates user profiles that can be used to restrict user access. Profiles are an effective tool to improve your user security.

Remedy:

Create a profile and assign it to the user account. To create a profile in the System Policy Editor:

  1. Open the System Policy Editor.
  2. From the File menu, select New Policy to display the Default User and Default User icons.
  3. Set the options of the new policy:
    • Double-click the Default Computer icon and select the computer policy options.
    • Double-click the Default User icon and select the user policy options.
    • (Optional) Add additional users, computers, or groups to the new policy.
  4. Click OK.
  5. Save the file as NTCONFIG.POL in the netlogon share of the PDC/BDC.

—AND—

To assign a profile to a user:

  1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), User Manager.
  2. Select the user from the list.
  3. From the User menu, select Properties to display the User Properties dialog box.
  4. Click Profile to display the User Environment Profile dialog box.
  5. Add the User Profile Path for this user.
  6. Click OK.

For more information on the System Policy Editor, see Microsoft Knowledge Base Article "What is your Setting the User Policy issue?" at http://support.microsoft.com/support/ntserver/serviceware/10141629.ASP.

References:

X-Force Logo
Know Your Risks