🔨
W.I.P. see Windows 10.This is being worked on now!
📃 This documentation is being swiftly written in preparation for the CyberPatriot Nationals. Basically, it might be a little messy.
📃 You will need to install GPMC! Refer to: Link and you will need a domain user account: Link
-
-
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Enforce password historySetting: 24 or more password(s)
Links: 1
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Maximum password ageSetting: 365 or fewer, but not 0
Links: 1
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Minimum password ageSetting: 1 or more day(s)
Links: 1
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Minimum password lengthSetting: 14 or more character(s)
Links: 1
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirementsSetting: Enabled
Links: 1
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Store passwords using reversible encryptionSetting: Disabled
Links: 1
-
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policy\Account lockout durationSetting: 15 or more minute(s)
Links: 1
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policy\Account lockout thresholdSetting: 5 or fewer invalid login attempt(s), but not 0
Links: 1
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policies\Allow Administrator account lockoutSetting: Enabled
Links: 1
Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policy\Reset account lockout counter afterSetting: 15 or more minute(s)
Links: 1
-
-
-
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Access Credential Manager as a trusted callerSetting: No One
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Access this computer from the networkComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Access this computer from the networkComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Act as part of the operating systemSetting: No One
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Add workstations to domainSetting: Administrators
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Adjust memory quotas for a processSetting: Administrators, LOCAL SERVICE, NETWORK SERVICE
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on locallyComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on through Remote Desktop ServicesComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on through Remote Desktop ServicesComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Back up files and directoriesComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Change the system timeComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Change the time zoneComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Create a pagefileComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Create a token objectComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Create global objectsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Create permanent shared objectsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Create symbolic linksComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Create symbolic linksComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Debug programsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny access to this computer from the networkComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on as a batch jobComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on as a serviceComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on locallyComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on through Remote Desktop ServicesComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Enable computer and user accounts to be trusted for delegationComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Enable computer and user accounts to be trusted for delegationComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Force shutdown from a remote systemComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Generate security auditsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Impersonate a client after authenticationComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Impersonate a client after authenticationComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Increase scheduling priorityComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Load and unload device driversComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Lock pages in memoryComputer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Log on as a batch jobComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Manage auditing and security logComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Manage auditing and security logComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Modify an object labelComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Modify firmware environment valuesComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Perform volume maintenance tasksComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Profile single processComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Profile system performanceComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Replace a process level tokenComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Restore files and directoriesComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Shut down the systemComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Synchronize directory service dataComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Take ownership of files or other objectsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Take ownership of files or other objects -
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Block Microsoft accountsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Guest account statusComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Limit local account use of blank passwords to console logon onlyComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Rename administrator accountComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Rename guest accountComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settingsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Audit: Shut down system immediately if unable to log security auditsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Audit: Shut down system immediately if unable to log security auditsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Devices: Prevent users from installing printer driversComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Do not require CTRL+ALT+DELComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Don't display last signed-inComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Machine inactivity limitComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Message text for users attempting to log onComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Message title for users attempting to log onComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Prompt user to change password before expirationComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Require Domain Controller Authentication to unlock workstationComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Smart card removal behaviorComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network client: Digitally sign communications (always)Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network client: Digitally sign communications (if server agrees)Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network client: Send unencrypted password to third-party SMB serversComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Amount of idle time required before suspending sessionComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Digitally sign communications (always)Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Digitally sign communications (if client agrees)Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Disconnect clients when logon hours expireComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Server SPN target name validation levelComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Allow anonymous SID/Name translationComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Do not allow anonymous enumeration of SAM accountsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Do not allow anonymous enumeration of SAM accounts and sharesComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Do not allow storage of passwords and credentials for network authenticationComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Let Everyone permissions apply to anonymous usersComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Named Pipes that can be accessed anonymouslyComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Named Pipes that can be accessed anonymouslyComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Remotely accessible registry pathsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Remotely accessible registry paths and sub-paths- Set to:
System\CurrentControlSet\Control\Print\Printers System\CurrentControlSet\Services\EventlogSoftware\Microsoft\OLAP ServerSoftware\Microsoft\Windows NT\CurrentVersion\PrintSoftware\Microsoft\Windows NT\CurrentVersion\Windows System\CurrentControlSet\Control\ContentIndex System\CurrentControlSet\Control\Terminal Server System\CurrentControlSet\Control\Terminal Server\UserConfig System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration Software\Microsoft\Windows NT\CurrentVersion\Perflib System\CurrentControlSet\Services\SysmonLogComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Restrict anonymous access to Named Pipes and SharesComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Restrict clients allowed to make remote calls to SAMComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Shares that can be accessed anonymouslyComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Sharing and security model for local accountsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Allow Local System to use computer identity for NTLMComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Allow LocalSystem NULL session fallbackComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network Security: Allow PKU2U authentication requests to this computer to use online identitiesComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Configure encryption types allowed for KerberosComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Do not store LAN Manager hash value on next password changeComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Force logoff when logon hours expireComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: LAN Manager authentication levelComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: LDAP client signing requirementsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Minimum session security for NTLM SSP based (including secure RPC) clientsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Minimum session security for NTLM SSP based (including secure RPC) serversComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Restrict NTLM: Audit Incoming NTLM TrafficComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Restrict NTLM: Outgoing NTLM traffic to remote serversComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Shutdown: Allow system to be shut down without having to log onComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\System objects: Require case insensitivity for non�Windows subsystemsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator accountComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval ModeComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard usersComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Detect application installations and prompt for elevationComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Only elevate UIAccess applications that are installed in secure locationsComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval ModeComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Switch to the secure desktop when prompting for elevationComputer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Virtualize file and registry write failures to per-user locations
-
-
Computer Configuration\Policies\Windows Settings\Security Settings\System Services\Print SpoolerComputer Configuration\Policies\Windows Settings\Security Settings\System Services\Print Spooler
-
-
- Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile :EnableFirewallTo establish the recommended configuration via GP, set the following UI path to On (recommended):
Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Firewall stateDefault value: On (recommended)
-
9.2.2 Ensure 'Windows Firewall: Private: Inbound connections' is set to 'block (default)'(Automated)
Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile :DefaultInboundActionTo establish the recommended configuration via GP, set the following UI path to Block (default):
Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Inbound connectionsDefault value: Block (Default) (recommended)
Note: If you set Outbound connections to Block and then deploy the firewall policy by using a GPO, computers that receive the GPO settings cannot receive subsequent Group Policy updates unless you create and deploy an outbound rule that enables Group Policy to work. Predefined rules for Core Networking include outbound rules that enable Group Policy to work. Ensure that these outbound rules are active, and thoroughly test firewall profiles before deploying.
Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile :DefaultOutboundActionTo establish the recommended configuration via GP, set the following UI path to Allow (default):
Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Outbound connectionsDefault Value: Allow
-
9.2.4 Ensure 'Windows Firewall: Private: Settings: displat a notification' is set to 'no' (Automated)
To establish the recommended configuration via GP, set the following UI path to No:
Computer Configuration\Policies\Windows Settings\Security Settings\WindowsDefender Firewall with Advanced Security\Window Defender Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Settings Customize\Display a notificationDefalut Value: Yes
***Recommended Value: no *** -
9.2.5 Ensure 'Windows Firewall: Private: Logging: Name' is set to '%SystemTooy%\System32\logfiles\firewall\Privatefw.log'(Automated)
To establish the recommended configuration via GP, set the following UI path to %SystemRoot%\System32\logfiles\firewall\privatefw.log:
Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Logging Customize\NameDefault Value: %SystemRoot%\System32\logfiles\firewall\pfirewall.log (Recommended)
-
9.2.6 Ensure 'Windows Firewall: Private: Logging: Size limit (KB)'' is set to '16,384 KB' or greater (Automated).
To establish the recommended configuration via GP, set the following UI path to 16,384 KB or greater:
Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Logging Customize\Size limit (KB)Defalut Value: 4,096 KB ***Recommended Value: 16,384 KB' or greater ***
-
To establish the recommended configuration via GP, set the following UI path to Yes:
Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Logging Customize\Log dropped packetsDefalut Value: No
***Recommended Value: Yes *** -
To establish the recommended configuration via GP, set the following UI path to Yes:
Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Logging Customize\Log successful connectionsDefalut Value: No
***Recommended Value: Yes ***
-
9.3.1 (L1) Ensure 'Windows Firewall: Public: Firewall state' is set to 'On (recommended)' (Automated)
To establish the recommended configuration via GP, set the following UI path to ***On(recommended)***: ``` Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Firewall state ``` Default Value: **On** **(Recommended)**-
To establish the recommended configuration via GP, set the following UI path to Block (default):
9.3.2 (L1) Ensure 'Windows Firewall: Public: Inbound connections' is set to 'Block (default)' (Automated)
Default Value: Block (Recommended)Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Inbound connections -
To establish the recommended configuration via GP, set the following UI path to Allow (default):
9.3.3 (L1) Ensure 'Windows Firewall: Public: Outbound connections' is set to 'Allow (default)' (Automated)
Default Value: Allow (Recommended)Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Outbound connections -
To establish the recommended configuration via GP, set the following UI path to 'No':
9.3.4 (L1) Ensure 'Windows Firewall: Public: Settings: Display a notification' is set to 'No' (Automated)
Defalut Value: YesComputer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Settings Customize\Display a notification
***Recommended Value: No *** -
To establish the recommended configuration via GP, set the following UI path to No:
9.3.5 (L1) Ensure 'Windows Firewall: Public: Settings: Apply local firewall rules' is set to 'No' (Automated)
Defalut Value: YesComputer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Settings Customize\Apply local firewall rules
***Recommended Value: No *** -
To establish the recommended configuration via GP, set the following UI path to No:
9.3.6 (L1) Ensure 'Windows Firewall: Public: Settings: Apply local connection security rules' is set to 'No' (Automated)
Defalut Value: YesComputer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Settings Customize\Apply local connection security rules
***Recommended Value: No *** -
To establish the recommended configuration via GP, set the following UI path to %SystemRoot%\System32\logfiles\firewall\publicfw.log:
9.3.7 (L1) Ensure 'Windows Firewall: Public: Logging: Name' is set to '%SystemRoot%\System32\logfiles\firewall\publicfw.log'(Automated)
Default Value: %SystemRoot%\System32\logfiles\firewall\pfirewall.logComputer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Logging Customize\Name -
To establish the recommended configuration via GP, set the following UI path to 16,384 KB or greater:
9.3.8 (L1) Ensure 'Windows Firewall: Public: Logging: Size limit (KB)' is set to '16,384 KB or greater' (Automated)
Default Value: 4,096 KBComputer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Logging Customize\Size limit (KB)
***Recommended Value: 16,384 KB or greater *** -
To establish the recommended configuration via GP, set the following UI path to Yes:
9.3.9 (L1) Ensure 'Windows Firewall: Public: Logging: Log dropped packets' is set to 'Yes' (Automated)
Default Value: NoComputer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Public Profile\Logging Customize\Log dropped packets
***Recommended Value: Yes *** -
To establish the recommended configuration via GP, set the following UI path to Yes:
9.3.10 (L1) Ensure 'Windows Firewall: Public: Logging: Log successful connections' is set to 'Yes' (Automated)
Default Value: NoComputer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Logging Customize\Log successful connections
***Recommended Value: Yes ***
-
-
This section contains recommendations for configuring the Windows audit facilities.
-
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon\Audit Credential Validation '''
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon\Audit Kerberos Authentication Service '''
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon\Audit Kerberos Service Ticket Operations '''
-
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Application Group Management '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Computer Account Management '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Distribution Group Management '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Other Account Management Events '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Security Group Management '''
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management '''
-
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Detailed Tracking\Audit PNP Activity '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Detailed Tracking\Audit Process Creation '''
-
To establish the recommended configuration via GP, set the following UI path to include Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Access '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes '''
-
To establish the recommended configuration via GP, set the following UI path to include Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Account Lockout '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Group Membership '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logoff '''
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logon '''
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Other Logon/Logoff Events '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Special Logon '''
-
To establish the recommended configuration via GP, set the following UI path to include Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit Detailed File Share '''
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit File Share '''
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit Other Object Access Events '''
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit Removable Storage '''
-
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Audit Policy Change '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Authentication Policy Change '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Authorization Policy Change '''
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit MPSSVC Rule-Level Policy Change '''
To establish the recommended configuration via GP, set the following UI path to include Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Other Policy Change Events '''
-
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Privilege Use\Audit Sensitive Privilege Use '''
-
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit IPsec Driver '''
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Other System Events '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security State Change '''
To establish the recommended configuration via GP, set the following UI path to include Success:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security System Extension '''
To establish the recommended configuration via GP, set the following UI path to Success and Failure:
''' Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit System Integrity '''
-
To establish the recommended configuration via GP, set the following UI path to Enabled:
''' Computer Configuration\Policies\Administrative Templates\Control Panel\Personalization\Prevent enabling lock screen camera '''
-
User Configuration\Policies\Administrative Templates\Control
Panel\Personalization\Enable screen saver
Setting: Enabled
'Enabled' (Automated)
User Configuration\Policies\Administrative Templates\Control
Panel\Personalization\Password protect the screen saver
Setting: Enabled
19.1.3.3 (L1) Ensure 'Screen saver timeout' is set to 'Enabled: 900 seconds or fewer, but not 0' (Automated)
User Configuration\Policies\Administrative Templates\Control
Panel\Personalization\Screen saver timeout
Setting: Enabled: 900 or fewer, but not 0
19.5.1.1 (L1) Ensure 'Turn off toast notifications on the lock screen' is set to 'Enabled' (Automated)
User Configuration\Policies\Administrative Templates\Start Menu and
Taskbar\Notifications\Turn off toast notifications on the lock screen
Setting: Enabled
19.6.6.1.1 (L2) Ensure 'Turn off Help Experience Improvement Program' is set to 'Enabled' (Automated)
User Configuration\Policies\Administrative Templates\System\Internet
Communication Management\Internet Communication Settings\Turn off Help
Experience Improvement Program
Setting: Enabled
19.7.4.1 (L1) Ensure 'Do not preserve zone information in file attachments' is set to 'Disabled' (Automated)
User Configuration\Policies\Administrative Templates\Windows
Components\Attachment Manager\Do not preserve zone information in file
attachments
Setting: Disabled
19.7.4.2 (L1) Ensure 'Notify antivirus programs when opening attachments' is set to 'Enabled' (Automated)
User Configuration\Policies\Administrative Templates\Windows
Components\Attachment Manager\Notify antivirus programs when opening
attachments
Setting: Enabled
User Configuration\Policies\Administrative Templates\Windows Components\Cloud
Content\Configure Windows spotlight on lock screen
Setting: Disabled
Links:
1
19.7.7.2 (L1) Ensure 'Do not suggest third-party content in Windows spotlight' is set to 'Enabled' (Automated)
User Configuration\Policies\Administrative Templates\Windows Components\Cloud
Content\Do not suggest third-party content in Windows spotlight
Setting: Enabled
19.7.7.3 (L2) Ensure 'Do not use diagnostic data for tailored experiences' is set to 'Enabled' (Automated)
User Configuration\Policies\Administrative Templates\Windows Components\Cloud
Content\Do not use diagnostic data for tailored experiences
Setting: Enabled
User Configuration\Policies\Administrative Templates\Windows Components\Cloud
Content\Turn off all Windows spotlight features
Setting: Enabled
set to 'Enabled' (Automated)
User Configuration\Policies\Administrative Templates\Windows Components\Cloud
Content\Turn off Spotlight collection on Desktop
Setting: Enabled
Links: 1
19.7.25.1 (L1) Ensure 'Prevent users from sharing files within their profile.' is set to 'Enabled' (Automated)
User Configuration\Policies\Administrative Templates\Windows
Components\Network Sharing\Prevent users from sharing files within their
profile.
Setting: Enabled
User Configuration\Policies\Administrative Templates\Windows
Components\Windows Installer\Always install with elevated privileges
Setting: Disabled:
Links: 1
User Configuration\Policies\Administrative Templates\Windows
Components\Windows Media Player\Playback\Prevent Codec Download
Setting: Enabled