Removing Support for OS/2 Subsystem

---

The Windows NT Resource Kit includes a utility called the C2 Configuration Tool. The National Computer Security Center has created a set of security standards that have been called the Orange Book. Windows NT 3.5x was evaluated as being C2 secure according to the specifications of the Orange Book. The Windows NT operating system supports security that is not part of the C2 security definition.

The OS/2 Subsystem is not included in the current C2 security definition. To meet the C2 security standards, the OS/2 Subsystem should be disabled. The C2 Configuration Tool accomplishes this by deleting the OS2.exe and OS2ss.exe files from the %systemroot%\system32 subdirectory.




Another reason to disable the OS/2 Subsystem is because you are not using any OS/2 applications. If you need to restore the OS/2 Subsystem, OS2.exe and OS2ss.exe must be restored from the original Windows NT distribution files. To do this, you use the Expand command.

The steps to disable the OS/2 Subsystem are as follows:

1.	Start the C2 Configuration Tool. By default, it is located by choosing from the Start menu, Programs, Resource Kit 4.0, Configuration, C2 Configuration.
2.	In the list of Security Features, select the OS/2 Subsystem entry.
3.	Double-click on the OS/2 Subsystem entry. A dialog box appears (see Figure 5.21).
4.	Click on the OK button to disable the OS/2 Subsystem. A confirmation dialog box asks you to verify that you do wish to remove the OS/2 Subsystem from the computer and tells you that this is not reversible. If this is acceptable, click on the OK button.
5.	The icon to the left of the OS/2 Subsystem now appears as a red, closed lock, indicating full C2 Orange Book compliance.