FOR USE ON MICROSOFT WINDOWS NT 4.0 ONLY
WARNING: Using Registry Editor incorrectly can cause serious, system-wide problems
that may require you to reinstall Windows NT to correct them. Microsoft cannot
guarantee that any problems resulting from the use of Registry Editor can be solved.
Use this tool and my regpacks at your own risk. 
vacuum@technotronic.com

Registry Modifications

I threw together some easy registry modifications.
If you run webtrends Security Analyzer, your machine will most likely need some of these
registry modifications to enhance security.

restrictlogaccess.reg restricts guest access to the system, applications, and security logs.
hidelastlogin.reg stops the last userid that logged into the machine from being dislplayed.
nolm.reg Disables the LanMangager Hash
lmonrequest.reg enables LanManger Hashes only upon server request
disablenullsessions.reg restricts anonymous logins.

Completely Disabling File and Print Sharing Under Windows NT:

To completely disallow any sharing of system File and Print resources,
it is possible to disable the Server service in Control Panel>Services.
To do this, go into Control Panel>Services, select the Server service,
click the Startup button, click Disabled and click OK. Then, with the
Server service still selected, click on the Stop button. This will stop
the Server service immediately, otherwise, on the next reboot of NT the
Server service will not start by default. 

How to Install Strong Password Filtering
To ensure Strong Password functionality occurs throughout your domain
structure, make the following changes on all primary domain controllers
(or stand-alone servers, where needed). 

PASSFILT.DLL is not necessary on backup domain controllers since the PDC
is the only machine where changes to the domain accounts database are made.
However, it should be installed on all BDCs because they can be promoted to
PDC. If a BDC without PASSFILT.DLL is promoted to PDC, then strong password
enforcement will be lost but there will be no other adverse effects. 

1) Install the latest Windows NT 4.0 service pack. 

2) Copy Passfilt.dll to the %SYSTEMROOT%\SYSTEM32 folder. 

3) Use Registry Editor (Regedt32.exe) to add the value "Notification Packages",
   of type REG_MULTI_SZ, under the LSA key. 
   NOTE: If this key already exists, go to Step 4. 
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

4) Double-click the "Notification Packages" key and add the following value: 
   NOTE: If the value FPNWCLNT is already present, place the following entry
   beneath the FPNWCLNT entry: 

      PASSFILT

5) Click OK and then exit Registry Editor. 

6) Shut down and restart the computer running Windows NT Server. 


