Windows Vista Security Guide Release Notes
January 23, 2007
© 2006 Microsoft Corporation. All rights reserved. 

Contents
1.	Windows Vista Security Guide
2.	Getting started
3.	Download component location and descriptions
4.	Windows Vista version used
5.	Changes in this version
6.	Known issues
7.	Security guide history
8.	Copyright and license agreement

Windows Vista Security Guide
•	Obtain updated release notes and download the Windows Vista Security Guide from the Microsoft Download Center.
•	View the Windows Vista Security Guide on Microsoft TechNet.

Getting started
To start using this solution accelerator, Microsoft recommends first reading the "Overview" section of the guide. The Overview defines the purpose and scope of the guide, the intended audience for the guide, and indicates how the guidance is organized to assist you in locating the information that is relevant to you. It also describes the tools and templates that accompany the guide, and the user prerequisites for the guidance.

Download component locations and descriptions
When you install the Windows Vista Security Guide, the GPOAccelerator tool is selected by default to install with the other guidance that accompanies this tool. To use this tool requires administrative privileges. The default location for this solution accelerator installation is your Documents folder. The installation places a shortcut to the guide that opens the Windows Vista Security Guide folder. In addition, the Microsoft (.msi) Installer file installs both the Windows Vista Security Guide Download Page.lnk and the Windows Vista Security Guide on TechNet.lnk files in this folder for your convenience.
Note: Administrative installation of the .msi file is not supported.
If during the installation you choose to install only the Windows Vista Security Guide for this solution accelerator, you will receive the following files:
	Windows Vista Security Guide.msi
 Windows Vista Security Guide.doc
This document provides security guidance for customers who are interested in hardening deployments of Windows Vista in their environments.
 Appendix A: Security Group Policy Settings.doc
This document provides detailed configuration settings for customers who are interested in hardening deployments of Windows Vista in their environments.
 Windows Vista Security Guide Settings.xls
                This worksheet file provides detailed comparative lists of the configuration settings and values for both the Enterprise Configuration (EC) and the Specialized Security – Limited Functionality (SSLF) configurations.
 Windows Vista Security Guide Download Page.lnk
This is a shortcut that you can use to access the Download Center on Microsoft.com to obtain more details about the current release of this guide.
 Windows Vista Security Guide on TechNet.lnk
This is a shortcut that you can use to view the Windows Vista Security Guide available on TechNet.
If during the installation you choose to install only the GPOAccelerator tool for this solution accelerator, you will install the following files:
	Windows Vista Security Guide.msi
 Windows Vista Security Guide Download Page.lnk
This is a shortcut that you can use to access the Download Center on Microsoft.com to obtain more details about the current release of this guide.
 Windows Vista Security Guide on TechNet.lnk
This is a shortcut that you can use to access the Download Center on Microsoft.com to obtain more details about the current release of this guide.
            GPOAccelerator Tool
                  This is the top-level folder in which you can access the GPOAccelerator tool.
      Security Templates
        This folder contains the Security Template .inf files that you can use to implement some of the security settings that this guide prescribes.
      SCE Update
      This folder contains files and scripts that you can use to update the Security Configuration Editor (SCE).
      Security Group Policy Objects
      This folder contains scripts and Microsoft Group Policy Management Console (GPMC) backup files that are required to implement the Group Policy objects (GPOs) that this guide prescribes.
If you choose to install the default selection of both the Windows Vista Security Guide and the GPOAccelerator tool for this solution accelerator, you will install the following files:
	Windows Vista Security Guide.msi
 Windows Vista Security Guide.doc
This document provides security guidance for customers who are interested in hardening deployments of Windows Vista in their environments.
 Appendix A: Security Group Policy Settings.doc
This document provides detailed configuration settings for customers who are interested in hardening deployments of Windows Vista in their environments.
 Windows Vista Security Guide Settings.xls
                This worksheet file provides detailed comparative lists of the configuration settings and values for both the Enterprise Configuration (EC) and the Specialized Security – Limited Functionality (SSLF) configurations.
 Windows Vista Security Guide Download Page.lnk
This is a shortcut that you can use to access the Download Center on Microsoft.com to obtain more details about the current release of this guide.
 Windows Vista Security Guide on TechNet.lnk
This is a shortcut that you can use to access the Download Center on Microsoft.com to obtain more details about the current release of this guide.
            GPOAccelerator tool
                  This is the top-level folder in which you can access the GPOAccelerator tool 
      Security Templates
 This folder contains the Security Template .inf files that you can use to implement some of the security settings that this guide prescribes.
      SCE Update
             This folder contains files and scripts that you can use to update the Security Configuration Editor (SCE).
      Security Group Policy Objects
               This folder contains scripts and Microsoft Group Policy Management Console (GPMC) backup files that are required to implement the Group Policy objects (GPOs) that this guide prescribes.

Windows Vista version used
This version of the Windows Vista Security Guide was developed and tested using the released builds for Windows Vista Ultimate, Windows Vista Business, and Windows Vista Enterprise Edition.

Changes in this version
Microsoft has published guides for both Windows XP with Service Pack 1 (SP1) and Windows XP with SP2. This guide, which reflects the significant security enhancements in Windows Vista, was developed and tested on computers running Windows Vista joined to a domain that uses Active Directory, and on stand-alone computers.

Known issues
The following are known issues for this release of the Windows Vista Security Guide:
•	The SSLF configuration currently prescribed in the guide contains a setting recommendation that prevents the Windows Audio service from starting correctly. The Windows Audio service manages audio for Windows programs. If this service is stopped, audio devices do not function properly. To ensure this service starts correctly on SSLF computers, the Increase a process working set setting under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignments must include the following groups: Administrators, LOCAL SERVICE. (01-23-07)

The following locations in the guide improperly specify the configuration of this setting: 

•	Table A15 in Appendix A specifies that the Increase a process working set setting should be configured only to Administrators the same is specified in the setting description on page 25. The correct configuration of the setting should include Administrators and Local Service.
•	Line 42 of the Computer Policy Settings sheet in the Windows Vista Security Guide Settings.xls specifies only Administrators. Cells N42 and O42 should both contain Administrators, LOCAL SERVICE. 
•	The SSLF Laptop and Desktop GPOs created by the GPOAccelerator tool, as well as the SSLF security templates (.inf files) included with the guide configures the setting for the Administrators group only. For the Windows Audio service to start correctly, the Increase a process working set setting in these GPOs must include the following groups: Administrators, LOCAL SERVICE.
•	The GPOAccelerator tool had some files missing that resulted in the tool not functioning properly.  The files were missing from the 12-04-06 release only. (12-20-06)

•	Version 1.1 of the download file—Windows Vista Security Guide.msi—that was published 12-04-06 did not include all of the GPOAccelerator Tool files.  The file was replaced with version 1.0 on 12-14-06. (12-14-06)

•	The "Limited Services" section in Chapter 5, "Specialized Security – Limited Functionality" was included in error. The GPOs and .inf files that the guide includes do not modify the configuration of any default services on computers running Windows Vista. (12-01-06)

•	Users may notice one or more additional “Extra Registry Settings” entries in the reports generated by the Group Policy Results report in the Group Policy Management Console and the Resultant Set of Policy tools. This has no impact on the expected behavior of the Group Policy settings detailed in this guide and is expected behavior for this release of Windows Vista. (11-08-06)

•	Administrative installation of the .msi file is not supported. (11-08-06)

Security guide history
The Solution Accelerators – Security and Compliance (SASC) team developed the Windows Vista Security Guide v1.0 based on the Windows XP Security Guide. The new guidance provides recommendations for dozens of Group Policy security settings that are designed to assist customers in making their environments more secure.
In the past, deploying the prescribed security guidance was a long and tedious process that involved multiple manual steps. Correctly deploying the security guidance, even in a test environment, could take hours. The new guide includes tools and templates that take advantage of built-in Windows Vista features to enable users to deploy all the prescribed settings within a few minutes.
This guide has been reviewed and tested by Microsoft engineering teams, consultants, support engineers, partners, and customers in an effort to make it:
• Proven -- Based on field experience.
• Authoritative -- Offers the best advice available.
• Accurate -- Technically validated and tested.
• Actionable -- Provides the steps to success.
• Relevant -- Addresses real-world security concerns.
As in previous security guides, this guide describes the following two environments:
• Enterprise Client (EC). Client computers in this environment are located in an Active Directory domain and only need to communicate with systems running Microsoft Windows Server 2003. Client computers in this environment include a mixture: some run Windows Vista while others run Windows XP.
• Specialized Security – Limited Functionality (SSLF). Concern for security in this environment is so great that a significant loss of functionality and manageability is acceptable. For example, military and intelligence agency computers operate in this type of environment. The client computers in this environment run only Windows Vista.
This guide includes recommendations for Group Policy settings that are specific to each of these environments, as well as recommendations for an organizational unit (OU) structure that is adequate for deploying the settings in either environment.

Copyright and license agreement
© 2006 Microsoft Corporation.  This work is licensed under the Creative Commons Attribution-NonCommercial License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc/2.5/ or send a letter to Creative Commons, 543 Howard Street, 5th Floor, San Francisco, California, 94105, USA.