Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

With a metasploit module and POC code available, there's a growing concern about the DLL path-searching vulnerability in an increasing number of Microsoft and 3rd party applications. It appears that ensuring SafeDLLSearchMode is enabled mitigates the vlunerability, and I would like to enforce this on a network via Group Policy. While it's enabled by default in XP SP2+ and requires a registry edit to disable, I'd like to find an ADM file (or perhaps there's an existing policy setting I'm missing) that will let me ensure it remains active.

Does anyone know if anything like this is out there, or could anyone suggest how such an ADM file should look? The key in question is:

HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode

With a value of 1 for enabled and 0 for disabled.

share|improve this question
1  
Do you have Client-Side Preferences available on your workstations? –  jscott Aug 25 '10 at 17:45
    
Our Windows Servers are all 2003 and 2003 R2. My understanding is you need at least one 2008 server to administer Client-Side Preferences. Sounds like a pretty useful feature, though. –  nedm Aug 25 '10 at 18:01
1  
No, you don't need 2008 Server. You will need RSAT on Vista or Windows 7 to manage the CSPs in Group Policy though. Your clients will also need the CSP extension installed. –  jscott Aug 25 '10 at 18:06
    
That's great, thanks for the info -- will look into this. –  nedm Aug 25 '10 at 18:10

1 Answer 1

up vote 2 down vote accepted

Here is an ADM you can use to apply this preference. If you had Client-Side Preferences you could better manage this setting.

CLASS MACHINE
CATEGORY "Extras"
  CATEGORY "Software Settings"
    CATEGORY "Safe DLL Search Mode"
        POLICY "Safe DLL Search Mode"
          KEYNAME "System\CurrentControlSet\Control\Session Manager"
              EXPLAIN "Enable safe DLL search mode."
          VALUENAME "SafeDllSearchMode"
            VALUEON  NUMERIC 1
            VALUEOFF NUMERIC 0
        END POLICY
    END CATEGORY
  END CATEGORY
END CATEGORY

You can also change this value with a simple script:

REG ADD "HKLM\System\CurrentControlSet\Control\Session Manager" /v "SafeDllSearchMode" /t REG_DWORD /d "1" /f
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.