ReferenceCheck catalog
Windows (Intune-managed)
All 457 Windows (Intune-managed) checks - what each one checks, why, and the access used to evaluate it.
457 checks. Column "Access used" lists the application permissions and collected data sources this check's evaluation reads; "None" means Watchtower reads no tenant data for it.
| Check | Severity | What it checks | Why it matters | Access used |
|---|---|---|---|---|
Ensure 'Allow Cortana Above Lock' is set to 'Block'wt.windows.above-lock.allow-cortana-above-lock | HIGH | This policy setting determines whether or not the user can interact with Cortana using speech while the system is locked. | Access to any computer resource should not be allowed when the device is locked. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Microsoft accounts to be optional' is set to 'Enabled'wt.windows.app-runtime.allow-microsoft-accounts-to-be-optional | HIGH | This policy setting lets you control whether Microsoft accounts are optional for Windows Store apps that require an account to sign in. This policy only affects Windows Store apps that support it. | Enabling this setting allows an organization to use their enterprise user accounts instead of using their Microsoft accounts when accessing Windows store apps. This provides the organization with greater control over relevant credentials. Microsoft accounts cannot be centrally managed and as such enterprise credential security policies cannot be applied to them, which could put any information accessed by using Microsoft accounts at risk. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Block launching Universal Windows apps with Windows Runtime API access from hosted content.' is set to 'Enabled'wt.windows.app-runtime.block-launching | MEDIUM | This policy setting controls whether Microsoft Store apps with Windows Runtime API access directly from web content can be launched. | Blocking apps from the web with direct access to the Windows API can prevent malicious apps from being run on a system. Only system administrators should be installing approved applications. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'wt.windows.application.control-event-log-behavior-when-the-log-file-reaches-its-maximum-size | HIGH | Controls what the Application event log does once it reaches its configured maximum size. When disabled, the log overwrites the oldest events as needed instead of halting new event capture. | An attacker who can fill the Application log can stall further logging and hide post-exploitation activity from incident responders. Allowing roll-over preserves recent forensic evidence even when retention is misconfigured. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater'wt.windows.application.specify-the-maximum-log-file-size-kb | HIGH | This policy setting specifies the maximum size of the log file in kilobytes. The maximum log file size can be configured between 1 megabyte (1,024 kilobytes) and 4 terabytes (4,194,240 kilobytes) in kilobyte increments. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Do not preserve zone information in file attachments (User)' is set to 'Disabled'wt.windows.attachment-manager.do-not-preserve-zone-information-in-file-attachments-user | HIGH | This policy setting allows you to manage whether Windows marks file attachments with information about their zone of origin (such as restricted, Internet, intranet, local). This requires NTFS in order to function correctly, and will fail without notice on FAT32. By not preserving the zone information, Windows cannot make proper risk assessments. Note: The Attachment Manager feature warns users when opening or executing files which are marked as being from an untrusted source, unless/until the file's zone information has been removed via the "Unblock" button on the file's properties or via a separate tool such as Microsoft Sysinternals Streams. | A file that is downloaded from a computer in the Internet or Restricted Sites zone may be moved to a location that makes it appear safe, like an intranet file share, and executed by an unsuspecting user. The Attachment Manager feature will warn users when opening or executing files which are marked as being from an untrusted source, unless/until the file's zone information has been removed. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Notify antivirus programs when opening attachments (User)' is set to 'Enabled'wt.windows.attachment-manager.notify-antivirus-programs-when-opening-attachments-user | HIGH | This policy setting manages the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. Note: An updated antivirus program must be installed for this policy setting to function properly. | Antivirus programs that do not perform on-access checks may not be able to scan downloaded files. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Include command line in process creation events' is set to 'Enabled'wt.windows.audit-process-creation.include-command-line-in-process-creation-events | HIGH | This policy setting controls whether the process creation command line text is logged in security audit events when a new process has been created. Note: This feature that this setting controls was not originally supported in workstation OSes older than Windows 8.1. However, in February 2015 Microsoft added support for the feature to Windows 7 and Windows 8.0 via an update - KB3004375. Therefore, this setting is also important to set on those older OSes. | Capturing process command line information in event logs can be very valuable when performing forensic investigations of attack incidents. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Account Logon Audit Credential Validation' is set to 'Success and Failure'wt.windows.auditing.account-logon-audit-credential-validation | HIGH | This subcategory reports the results of validation tests on credentials submitted for a user account logon request. These events occur on the computer that is authoritative for the credentials. For domain accounts, the Domain Controller is authoritative, whereas for local accounts, the local computer is authoritative. In domain environments, most of the Account Logon events occur in the Security log of the Domain Controllers that are authoritative for the domain accounts. However, these events can occur on other computers in the organization when local accounts are used to log on. Events for this subcategory include: • 4774: An account was mapped for logon. • 4775: An account could not be mapped for logon. • 4776: The Domain Controller attempted to validate the credentials for an account. • 4777: The Domain Controller failed to validate the credentials for an account. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Account Logon Logoff Audit Account Lockout' is set to include 'Failure'wt.windows.auditing.account-logon-logoff-audit-account-lockout | HIGH | This subcategory reports when a user's account is locked out as a result of too many failed logon attempts. Events for this subcategory include: • 4625: An account failed to log on. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Account Logon Logoff Audit Group Membership' is set to include 'Success'wt.windows.auditing.account-logon-logoff-audit-group-membership | HIGH | This policy allows you to audit the group membership information in the user’s logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. Note: A Windows 10, Server 2016 or newer OS is required to access and set this value in Group Policy. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Account Logon Logoff Audit Logoff' is set to include 'Success'wt.windows.auditing.account-logon-logoff-audit-logoff | HIGH | This subcategory reports when a user logs off from the system. These events occur on the accessed computer. For interactive logons, the generation of these events occurs on the computer that is logged on to. If a network logon takes place to access a share, these events generate on the computer that hosts the accessed resource. If you configure this setting to No auditing, it is difficult or impossible to determine which user has accessed or attempted to access organization computers. Events for this subcategory include: • 4634: An account was logged off. • 4647: User initiated logoff. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Account Logon Logoff Audit Logon' is set to 'Success and Failure'wt.windows.auditing.account-logon-logoff-audit-logon | HIGH | This subcategory reports when a user attempts to log on to the system. These events occur on the accessed computer. For interactive logons, the generation of these events occurs on the computer that is logged on to. If a network logon takes place to access a share, these events generate on the computer that hosts the accessed resource. If you configure this setting to No auditing, it is difficult or impossible to determine which user has accessed or attempted to access organization computers. Events for this subcategory include: • 4624: An account was successfully logged on. • 4625: An account failed to log on. • 4648: A logon was attempted using explicit credentials. • 4675: SIDs were filtered. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Account Management Audit Application Group Management' is set to 'Success and Failure'wt.windows.auditing.account-management-audit-application-group-management | HIGH | This policy setting allows you to audit events generated by changes to application groups such as the following: • Application group is created, changed, or deleted. • Member is added or removed from an application group. Application groups are utilized by Windows Authorization Manager, which is a flexible framework created by Microsoft for integrating role-based access control (RBAC) into applications. More information on Windows Authorization Manager is available at MSDN - Windows Authorization Manager. Note: Although Microsoft "Deprecated" Windows Authorization Manager (AzMan) in Windows Server 2012 and 2012 R2, this feature still exists in the OS (unimproved), and therefore should still be audited. | Auditing events in this category may be useful when investigating an incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Audit Authentication Policy Change' is set to include 'Success'wt.windows.auditing.audit-authentication-policy-change | HIGH | This subcategory reports changes in authentication policy. Events for this subcategory include: • 4706: A new trust was created to a domain. • 4707: A trust to a domain was removed. • 4713: Kerberos policy was changed. • 4716: Trusted domain information was modified. • 4717: System security access was granted to an account. • 4718: System security access was removed from an account. • 4739: Domain Policy was changed. • 4864: A namespace collision was detected. • 4865: A trusted forest information entry was added. • 4866: A trusted forest information entry was removed. • 4867: A trusted forest information entry was modified. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Audit Authorization Policy Change' is set to include 'Success'wt.windows.auditing.audit-authorization-policy-change | HIGH | This subcategory reports changes in authorization policy. Events for this subcategory include: • 4703: A user right was adjusted. • 4704: A user right was assigned. • 4705: A user right was removed. • 4670: Permissions on an object were changed. • 4911: Resource attributes of the object were changed. • 4913: Central Access Policy on the object was changed. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Audit Changes to Audit Policy' is set to include 'Success'wt.windows.auditing.audit-changes-to-audit-policy | HIGH | This subcategory reports changes in audit policy including SACL changes. Events for this subcategory include: • 4715: The audit policy (SACL) on an object was changed. • 4719: System audit policy was changed. • 4902: The Per-user audit policy table was created. • 4904: An attempt was made to register a security event source. • 4905: An attempt was made to unregister a security event source. • 4906: The CrashOnAuditFail value has changed. • 4907: Auditing settings on object were changed. • 4908: Special Groups Logon table modified. • 4912: Per User Audit Policy was changed. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Audit File Share Access' is set to 'Success and Failure'wt.windows.auditing.audit-file-share-access | HIGH | This policy setting allows you to audit attempts to access a shared folder. Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. | In an enterprise managed environment, workstations should have limited file sharing activity, as file servers would normally handle the overall burden of file sharing activities. Any unusual file sharing activity on workstations may therefore be useful in an investigation of potentially malicious activity. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Audit Other Logon Logoff Events' is set to 'Success and Failure'wt.windows.auditing.audit-other-logon-logoff-events | HIGH | This subcategory reports other logon/logoff-related events, such as Remote Desktop Services session disconnects and reconnects, using RunAs to run processes under a different account, and locking and unlocking a workstation. Events for this subcategory include: • 4649: A replay attack was detected. • 4778: A session was reconnected to a Window Station. • 4779: A session was disconnected from a Window Station. • 4800: The workstation was locked. • 4801: The workstation was unlocked. • 4802: The screen saver was invoked. • 4803: The screen saver was dismissed. • 5378: The requested credentials delegation was disallowed by policy. • 5632: A request was made to authenticate to a wireless network. • 5633: A request was made to authenticate to a wired network. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Audit Security Group Management' is set to include 'Success'wt.windows.auditing.audit-security-group-management | HIGH | This subcategory reports each event of security group management, such as when a security group is created, changed, or deleted or when a member is added to or removed from a security group. If you enable this Audit policy setting, administrators can track events to detect malicious, accidental, and authorized creation of security group accounts. Events for this subcategory include: • 4727: A security-enabled global group was created. • 4728: A member was added to a security-enabled global group. • 4729: A member was removed from a security-enabled global group. • 4730: A security-enabled global group was deleted. • 4731: A security-enabled local group was created. • 4732: A member was added to a security-enabled local group. • 4733: A member was removed from a security-enabled local group. • 4734: A security-enabled local group was deleted. • 4735: A security-enabled local group was changed. • 4737: A security-enabled global group was changed. • 4754: A security-enabled universal group was created. • 4755: A security-enabled universal group was changed. • 4756: A member was added to a security-enabled universal group. • 4757: A member was removed from a security-enabled universal group. • 4758: A security-enabled universal group was deleted. • 4764: A group's type was changed. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Audit Security System Extension' is set to include 'Success'wt.windows.auditing.audit-security-system-extension | HIGH | This subcategory reports the loading of extension code such as authentication packages by the security subsystem. Events for this subcategory include: • 4610: An authentication package has been loaded by the Local Security Authority. • 4611: A trusted logon process has been registered with the Local Security Authority. • 4614: A notification package has been loaded by the Security Account Manager. • 4622: A security package has been loaded by the Local Security Authority. • 4697: A service was installed in the system. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Audit Special Logon' is set to include 'Success'wt.windows.auditing.audit-special-logon | HIGH | This subcategory reports when a special logon is used. A special logon is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. Events for this subcategory include: • 4964: Special groups have been assigned to a new logon. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Audit User Account Management' is set to 'Success and Failure'wt.windows.auditing.audit-user-account-management | HIGH | This subcategory reports each event of user account management, such as when a user account is created, changed, or deleted; a user account is renamed, disabled, or enabled; or a password is set or changed. If you enable this Audit policy setting, administrators can track events to detect malicious, accidental, and authorized creation of user accounts. Events for this subcategory include: • 4720: A user account was created. • 4722: A user account was enabled. • 4723: An attempt was made to change an account's password. • 4724: An attempt was made to reset an account's password. • 4725: A user account was disabled. • 4726: A user account was deleted. • 4738: A user account was changed. • 4740: A user account was locked out. • 4765: SID History was added to an account. • 4766: An attempt to add SID History to an account failed. • 4767: A user account was unlocked. • 4780: The ACL was set on accounts which are members of administrators groups. • 4781: The name of an account was changed: • 4794: An attempt was made to set the Directory Services Restore Mode. • 5376: Credential Manager credentials were backed up. • 5377: Credential Manager credentials were restored from a backup. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Detailed Tracking Audit PNP Activity' is set to include 'Success'wt.windows.auditing.detailed-tracking-audit-pnp-activity | HIGH | This policy setting allows you to audit when plug and play detects an external device. Note: A Windows 10, Server 2016 or newer OS is required to access and set this value in Group Policy. | Enabling this setting will allow a user to audit events when a device is plugged into a system. This can help alert IT staff if unapproved devices are plugged in. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Detailed Tracking Audit Process Creation' is set to include 'Success'wt.windows.auditing.detailed-tracking-audit-process-creation | HIGH | This subcategory reports the creation of a process and the name of the program or user that created it. Events for this subcategory include: • 4688: A new process has been created. • 4696: A primary token was assigned to process. Refer to Microsoft Knowledge Base article 947226: Description of security events in Windows Vista and in Windows Server 2008 for the most recent information about this setting. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Object Access Audit Detailed File Share' is set to include 'Failure'wt.windows.auditing.object-access-audit-detailed-file-share | HIGH | This subcategory allows you to audit attempts to access files and folders on a shared folder. Events for this subcategory include: • 5145: network share object was checked to see whether client can be granted desired access. | Auditing the Failures will log which unauthorized users attempted (and failed) to get access to a file or folder on a network share on this computer, which could possibly be an indication of malicious intent. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Object Access Audit Other Object Access Events' is set to 'Success and Failure'wt.windows.auditing.object-access-audit-other-object-access-events | HIGH | This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. For scheduler jobs, the following are audited: • Job created. • Job deleted. • Job enabled. • Job disabled. • Job updated. For COM+ objects, the following are audited: • Catalog object added. • Catalog object updated. • Catalog object deleted. | The unexpected creation of scheduled tasks and COM+ objects could potentially be an indication of malicious activity. Since these types of actions are generally low volume, it may be useful to capture them in the audit logs for use during an investigation. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Object Access Audit Removable Storage' is set to 'Success and Failure'wt.windows.auditing.object-access-audit-removable-storage | HIGH | This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. Note: A Windows 8.0, Server 2012 (non-R2) or newer OS is required to access and set this value in Group Policy. | Auditing removable storage may be useful when investigating an incident. For example, if an individual is suspected of copying sensitive information onto a USB drive. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Policy Change Audit MPSSVC Rule Level Policy Change' is set to 'Success and Failure'wt.windows.auditing.policy-change-audit-mpssvc-rule-level-policy-change | HIGH | This subcategory determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). Events for this subcategory include: • 4944: The following policy was active when the Windows Firewall started. • 4945: A rule was listed when the Windows Firewall started. • 4946: A change has been made to Windows Firewall exception list. A rule was added. • 4947: A change has been made to Windows Firewall exception list. A rule was modified. • 4948: A change has been made to Windows Firewall exception list. A rule was deleted. • 4949: Windows Firewall settings were restored to the default values. • 4950: A Windows Firewall setting has changed. • 4951: A rule has been ignored because its major version number was not recognized by Windows Firewall. • 4952: Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced. • 4953: A rule has been ignored by Windows Firewall because it could not parse the rule. • 4954: Windows Firewall Group Policy settings have changed. The new settings have been applied. • 4956: Windows Firewall has changed the active profile. • 4957: Windows Firewall did not apply the following rule. • 4958: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer. The recommended state for this setting is: Success and Failure | Changes to firewall rules are important for understanding the security state of the computer and how well it is protected against network attacks. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Policy Change Audit Other Policy Change Events' is set to include 'Failure'wt.windows.auditing.policy-change-audit-other-policy-change-events | HIGH | This subcategory contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations. Events for this subcategory include: • 5063: A cryptographic provider operation was attempted. • 5064: A cryptographic context operation was attempted. • 5065: A cryptographic context modification was attempted. • 5066: A cryptographic function operation was attempted. • 5067: A cryptographic function modification was attempted. • 5068: A cryptographic function provider operation was attempted. • 5069: A cryptographic function property operation was attempted. • 5070: A cryptographic function property modification was attempted. • 6145: One or more errors occurred while processing security policy in the group policy objects. | This setting can help detect errors in applied Security settings which came from Group Policy, and failure events related to Cryptographic Next Generation (CNG) functions. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Privilege Use Audit Sensitive Privilege Use' is set to 'Success and Failure'wt.windows.auditing.privilege-use-audit-sensitive-privilege-use | HIGH | This subcategory reports when a user account or service uses a sensitive privilege. A sensitive privilege includes the following user rights: • Act as part of the operating system • Back up files and directories • Create a token object • Debug programs • Enable computer and user accounts to be trusted for delegation • Generate security audits • Impersonate a client after authentication • Load and unload device drivers • Manage auditing and security log • Modify firmware environment values • Replace a process-level token • Restore files and directories • Take ownership of files or other objects Auditing this subcategory will create a high volume of events. Events for this subcategory include: • 4672: Special privileges assigned to new logon. • 4673: A privileged service was called. • 4674: An operation was attempted on a privileged object. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'System Audit I Psec Driver' is set to 'Success and Failure'wt.windows.auditing.system-audit-i-psec-driver | HIGH | This subcategory reports on the activities of the Internet Protocol security (IPsec) driver. Events for this subcategory include: • 4960: IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations. • 4961: IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer. • 4962: IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay. • 4963: IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt. • 4965: IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error may also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored. • 5478: IPsec Services has started successfully. • 5479: IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. • 5480: IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. • 5483: IPsec Services failed to initialize RPC server. IPsec Services could not be started. • 5484: IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. • 5485: IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'System Audit Other System Events' is set to 'Success and Failure'wt.windows.auditing.system-audit-other-system-events | HIGH | This subcategory reports on other system events. Events for this subcategory include: • 5024: The Windows Firewall Service has started successfully. • 5025: The Windows Firewall Service has been stopped. • 5027: The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy. • 5028: The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy. • 5029: The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy. • 5030: The Windows Firewall Service failed to start. • 5032: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network. • 5033: The Windows Firewall Driver has started successfully. • 5034: The Windows Firewall Driver has been stopped. • 5035: The Windows Firewall Driver failed to start. • 5037: The Windows Firewall Driver detected critical runtime error. Terminating. • 5058: Key file operation. • 5059: Key migration operation. | Capturing these audit events may be useful for identifying when the Windows Firewall is not performing as expected. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'System Audit Security State Change' is set to include 'Success'wt.windows.auditing.system-audit-security-state-change | HIGH | This subcategory reports changes in security state of the system, such as when the security subsystem starts and stops. Events for this subcategory include: • 4608: Windows is starting up. • 4609: Windows is shutting down. • 4616: The system time was changed. • 4621: Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some audit-able activity might not have been recorded. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'System Audit System Integrity' is set to 'Success and Failure'wt.windows.auditing.system-audit-system-integrity | HIGH | This subcategory reports on violations of integrity of the security subsystem. Events for this subcategory include: • 4612: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. • 4615: Invalid use of LPC port. • 4618: A monitored security event pattern has occurred. • 4816: RPC detected an integrity violation while decrypting an incoming message. • 5038: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. • 5056: A cryptographic self test was performed. • 5057: A cryptographic primitive operation failed. • 5060: Verification operation failed. • 5061: Cryptographic operation. • 5062: A kernel-mode cryptographic self test was performed. | Auditing these events may be useful when investigating a security incident. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Disallow Autoplay for non-volume devices' is set to 'Enabled'wt.windows.autoplay-policies.disallow-autoplay-for-non-volume-devices | HIGH | This policy setting disallows AutoPlay for MTP devices like cameras or phones. | An attacker could use this feature to launch a program to damage a client computer or data on the computer. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Set the default behavior for AutoRun' is set to 'Enabled: Do not execute any autorun commands'wt.windows.autoplay-policies.set-the-default-behavior-for-autorun | HIGH | This policy setting sets the default behavior for Autorun commands. Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines. | Prior to Windows Vista, when media containing an autorun command is inserted, the system will automatically execute the program without user intervention. This creates a major security concern as code may be executed without user's knowledge. The default behavior starting with Windows Vista is to prompt the user whether autorun command is to be run. The autorun command is represented as a handler in the Autoplay dialog. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off Autoplay' is set to 'Enabled: All drives'wt.windows.autoplay-policies.turn-off-autoplay | HIGH | Autoplay starts to read from a drive as soon as you insert media in the drive, which causes the setup file for programs or audio media to start immediately. An attacker could use this feature to launch a program to damage the computer or data on the computer. Autoplay is disabled by default on some removable drive types, such as floppy disk and network drives, but not on CD-ROM drives. Note: You cannot use this policy setting to enable Autoplay on computer drives in which it is disabled by default, such as floppy disk and network drives. | An attacker could use this feature to launch a program to damage a client computer or data on the computer. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Warning For Other Disk Encryption: Allow Standard User Encryption' is set to 'Enabled'wt.windows.bitlocker.allow-standard-user-encryption | HIGH | This setting allows Admins to enforce "Require Device Encryption" policy for scenarios where policy is pushed while current logged-on user is non-admin/standard user. This policy is tied to "Allow Warning For Other Disk Encryption" policy being set to "0", i.e, Silent encryption is enforced. If "Allow Warning For Other Disk Encryption" isn't set, or is set to "1", "Require Device Encryption" policy won't try to encrypt drive(s) if a standard user is the current logged-on user in the system. | Enabling this ensures all fixed drives are encrypted regardless of the privileges assigned to the currently logged in user. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Warning For Other Disk Encryption' is set to 'Disabled'wt.windows.bitlocker.allow-warning-for-other-disk-encryption | HIGH | This setting allows Admin to disable all UI (notification for encryption and warning prompt for other disk encryption) and turn on encryption on the user machines silently. When you disable the warning prompt, the OS drive's recovery key will back up to the user's Microsoft Entra account. When you allow the warning prompt, the user who receives the prompt can select where to back up the OS drive's recovery key. The endpoint for a fixed data drive's backup is chosen in the following order: 1. The user's Windows Server Active Directory Domain Services account. 2. The user's Microsoft Entra account. 3. The user's personal OneDrive (MDM/MAM only). Encryption will wait until one of these three locations backs up successfully. Note: Starting in Windows 10, version 1803, the value 0 can only be set for Microsoft Entra joined devices. Windows will attempt to silently enable BitLocker for value 0. | Silent encryption enables BitLocker to encrypt data without prompting the user, ensuring the encryption process is uninterrupted. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require Device Encryption' is set to 'Enabled'wt.windows.bitlocker.require-device-encryption | HIGH | This setting allows the Admin to require encryption to be turned on using BitLocker\Device Encryption. Disabling the policy won't turn off the encryption on the system drive. But will stop prompting the user to turn it on. Note: Setting this policy to Enabled triggers encryption of all drives (silently or non- silently based on AllowWarningForOtherDiskEncryption policy). Note #2: Currently only full disk encryption is supported when using this CSP for silent encryption. For non-silent encryption, encryption type will depend on SystemDrivesEncryptionType and FixedDrivesEncryptionType configured on the device. | Encrypting drives on end-user devices helps prevent sensitive data at rest from being read in the event a device is lost or stolen. Enabling this setting is also a requirement to turning encryption on machines silently without prompting the end user. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Camera' is set to 'Not allowed'wt.windows.camera.allow-camera | MEDIUM | This policy setting controls whether the use of Camera devices on the machine are permitted. | Cameras in a high security environment can pose serious privacy and data exfiltration risks - they should be disabled to help mitigate that risk. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for fixed data drives' is set to 'XTS-AES 128-bit (default)' or 'XTS-AES 256-bit'wt.windows.choose-drive-encryption-method-and-cipher-strength-windows-10-version-1511-and-later.select-the-encryption-method-for-fixed-data-drives | HIGH | This policy setting determines which encryption method should be used for fixed data drives. The recommended state for this setting is: XTS-AES 128-bit (default) or XTS-AES 256-bit | Enforcing the default value of XTS-AES 128-bit (default) or higher helps ensure that a weaker cipher is not used to protect data on fixed data drives. | None - manual attestation (documented review step) |
Ensure 'Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for operating system drives' is set to 'XTS-AES 128-bit (default)' or 'XTS-AES 256-bit'wt.windows.choose-drive-encryption-method-and-cipher-strength-windows-10-version-1511-and-later.select-the-encryption-method-for-operating-system-drives | HIGH | This policy setting determines which encryption method should be used for operating system drives. The recommended state for this setting is: XTS-AES 128-bit (default) or XTS-AES 256-bit | Enforcing the default value of XTS-AES 128-bit (default) or higher helps ensure that a weaker cipher is not used to protect data on operating system drives. | None - manual attestation (documented review step) |
Ensure 'Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for removable data drives' is set to 'XTS-AES 128-bit' or higherwt.windows.choose-drive-encryption-method-and-cipher-strength-windows-10-version-1511-and-later.select-the-encryption-method-for-removable-data-drives | HIGH | This policy setting determines which encryption method should be used for operating system drives. The recommended state for this setting is: XTS-AES 128-bit or (higher) | The default value of AES-CBC 128-bit is used for backwards compatibility with other operating systems. Using the other available ciphers will increase the level of security for sensitive data, but it may impact compatibility with other operating systems. This setting is included in the benchmark because it is automatically added when 'Choose drive encryption method and cipher strength' is enabled. System administrators should use the most secure cipher available to them whenever possible. | None - manual attestation (documented review step) |
Ensure 'Config refresh' is set to 'Enabled' (Automated)wt.windows.config-refresh.config-refresh | HIGH | This policy setting determines whether or not MDM policies are refreshed on the system. | Policy CSP settings should be set to refresh at regular intervals to ensure constant compliance and to reduce policy drift. This helps to ensure systems stay in compliance. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Refresh cadence' is set to '90' (or less)wt.windows.config-refresh.refresh-cadence | HIGH | This policy setting determines how often MDM policies are refreshed on the system. | Policy CSP settings should be set to refresh at regular intervals to ensure constant compliance and to reduce policy drift. This helps to ensure systems stay in compliance. | None - manual attestation (documented review step) |
Ensure 'Allow users to connect remotely by using Remote Desktop Services' is set to 'Disabled'wt.windows.connections.allow-users-to-connect-remotely-by-using-remote-desktop-services | MEDIUM | This policy setting allows you to configure remote access to computers by using Remote Desktop Services. | Any account with the Allow log on through Remote Desktop Services user right can log on to the remote console of the computer. If you do not restrict access to legitimate users who need to log on to the console of the computer, unauthorized users could download and execute malicious code to elevate their privileges. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Do not display the password reveal button' is set to 'Enabled'wt.windows.credential-user-interface.do-not-display-the-password-reveal-button | HIGH | This policy setting allows you to configure the display of the password reveal button in password entry user experiences. | This is a useful feature when entering a long and complex password, especially when using a touchscreen. The potential risk is that someone else may see your password while surreptitiously observing your screen. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enumerate administrator accounts on elevation' is set to 'Disabled'wt.windows.credential-user-interface.enumerate-administrator-accounts-on-elevation | HIGH | This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. | Users could see the list of administrator accounts, making it slightly easier for a malicious user who has logged onto a console session to try to crack the passwords of those accounts. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Prevent the use of security questions for local accounts' is set to 'Enabled'wt.windows.credential-user-interface.prevent-the-use-of-security-questions-for-local-accounts | HIGH | This policy setting controls whether security questions can be used to reset local account passwords. The security question feature does not apply to domain accounts, only local accounts on the workstation. | Users could establish security questions that are easily guessed or sleuthed by observing the user’s social media accounts, making it easier for a malicious actor to change the local user account password and gain access to the computer as that user account. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Encryption Oracle Remediation' is set to 'Enabled: Force Updated Clients'wt.windows.credentials-delegation.encryption-oracle-remediation | HIGH | Some versions of the CredSSP protocol that is used by some applications (such as Remote Desktop Connection) are vulnerable to an encryption oracle attack against the client. This policy controls compatibility with vulnerable clients and servers and allows you to set the level of protection desired for the encryption oracle vulnerability. | This setting is important to mitigate the CredSSP encryption oracle vulnerability, for which information was published by Microsoft on 03/13/2018 in CVE-2018-0886 | CredSSP Remote Code Execution Vulnerability. All versions of Windows from Windows Vista onwards are affected by this vulnerability, and will be compatible with this recommendation provided that they have been patched at least through May 2018 (or later). | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Remote host allows delegation of non-exportable credentials' is set to 'Enabled'wt.windows.credentials-delegation.remote-host-allows-delegation-of-non-exportable-credentials | HIGH | Remote host allows delegation of non-exportable credentials. When using credential delegation, devices provide an exportable version of credentials to the remote host. This exposes users to the risk of credential theft from attackers on the remote host. The Restricted Admin Mode and Windows Defender Remote Credential Guard features are two options to help protect against this risk. Note: More detailed information on Windows Defender Remote Credential Guard and how it compares to Restricted Admin Mode can be found at this link: Protect Remote Desktop credentials with Windows Defender Remote Credential Guard (Windows 10) | Microsoft Docs | Restricted Admin Mode was designed to help protect administrator accounts by ensuring that reusable credentials are not stored in memory on remote devices that could potentially be compromised. Windows Defender Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting Kerberos requests back to the device that is requesting the connection. Both features should be enabled and supported, as they reduce the chance of credential theft. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Full Scan Removable Drive Scanning' is set to 'Allowed'wt.windows.defender-antivirus.allow-full-scan-removable-drive-scanning | HIGH | This policy setting allows you to manage whether or not to scan for malicious software and unwanted software in the contents of removable drives, such as USB flash drives, when running a full scan. | It is important to ensure that any present removable drives are always included in any type of scan, as removable drives are more likely to contain malicious software brought in to the enterprise managed environment from an external, unmanaged computer. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Behavior Monitoring' is set to 'Allowed'wt.windows.defender.allow-behavior-monitoring | HIGH | This policy setting allows you to configure behavior monitoring for Microsoft Defender Antivirus. | When running an antivirus solution such as Microsoft Defender Antivirus, it is important to ensure that it is configured to heuristically monitor in real-time for suspicious and known malicious activity. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Email Scanning' is set to 'Allowed'wt.windows.defender.allow-email-scanning | HIGH | This policy setting allows you to configure e-mail scanning. When e-mail scanning is enabled, the engine will parse the mailbox and mail files, according to their specific format, in order to analyze the mail bodies and attachments. Several e-mail formats are currently supported, for example: pst (Outlook), dbx, mbx, mime (Outlook Express), binhex (Mac). | Incoming e-mails should be scanned by an antivirus solution such as Microsoft Defender Antivirus, as email attachments are a commonly used attack vector to infiltrate computers with malicious software. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Realtime Monitoring' is set to 'Allowed'wt.windows.defender.allow-realtime-monitoring | HIGH | This policy setting configures real-time protection prompts for known malware detection. Microsoft Defender Antivirus alerts you when malware or potentially unwanted software attempts to install itself or to run on your computer. | When running an antivirus solution such as Microsoft Defender Antivirus, it is important to ensure that it is configured to heuristically monitor in real-time for suspicious and known malicious activity. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow scanning of all downloaded files and attachments' is set to 'Allowed'wt.windows.defender.allow-scanning-of-all-downloaded-files-and-attachments | HIGH | This policy setting configures scanning for all downloaded files and attachments. | When running an antivirus solution such as Microsoft Defender Antivirus, it is important to ensure that it is configured to heuristically monitor in real-time for suspicious and known malicious activity. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Script Scanning' is set to 'Allowed'wt.windows.defender.allow-script-scanning | HIGH | This policy setting allows script scanning to be turned on/off. Script scanning intercepts scripts then scans them before they are executed on the system. | When running an antivirus solution such as Microsoft Defender Antivirus, it is important to ensure that it is configured to heuristically monitor in real-time for suspicious and known malicious activity. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
**Ensure 'ASR: Block abuse of exploited vulnerable signed drivers' is set to 'Block**<br/>wt.windows.defender.block-abuse-of-exploited-vulnerable-signed-drivers-device` | HIGH | This rule prevents an application from writing a vulnerable signed driver to disk. Note: The Block abuse of exploited vulnerable signed drivers rule does not block a driver that already exists on the system from being loaded. | Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect systems. Vulnerable signed drivers can be exploited by local applications that have sufficient privileges to gain access to the kernel. This enables attackers to disable or circumvent security solutions, eventually leading to system compromise. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'ASR: Block Adobe Reader from creating child processes' is set to 'Block'wt.windows.defender.block-adobe-reader-from-creating-child-processes | HIGH | This rule prevents attacks by blocking Adobe Reader from creating processes. Malware can download and launch payloads and break out of Adobe Reader through social engineering or exploits. By blocking child processes from being generated by Adobe Reader, malware attempting to use Adobe Reader as an attack vector are prevented from spreading. | Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'ASR: Block all Office applications from creating child processes' is set to 'Audit' or higherwt.windows.defender.block-all-office-applications-from-creating-child-processes | HIGH | This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access. Creating malicious child processes is a common malware strategy. Malware that abuses Office as a vector often runs VBA macros and exploit code to download and attempt to run more payloads. However, some legitimate line-of-business applications might also generate child processes for benign purposes; such as spawning a command prompt or using PowerShell to configure registry settings. Configuring this setting to Block also conforms to the benchmark. | Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. | None - manual attestation (documented review step) |
Ensure 'ASR: Block credential stealing from the Windows local security authority subsystem' is set to 'Block'wt.windows.defender.block-credential-stealing-from-the-windows-local-security-authority-subsystem | HIGH | This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS). LSASS authenticates users who sign in on a Windows computer. Microsoft Defender Credential Guard in Windows normally prevents attempts to extract credentials from LSASS. Some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. Note: Enabling this rule doesn't provide additional protection if you have LSA protection enabled since the ASR rule and LSA protection work similarly. However, when LSA protection cannot be enabled, this rule can be configured to provide equivalent protection against malware that target lsass.exe. | Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'ASR: Block executable content from email client and webmail' is set to 'Block'wt.windows.defender.block-executable-content-from-email-client-and-webmail | HIGH | This rule blocks email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers from propagating the following file types: • Executable files (such as .exe, .dll, or .scr) • Script files (such as a PowerShell .ps1, Visual Basic .vbs, or JavaScript .js file) | Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion' is set to 'Audit' or higherwt.windows.defender.block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion | HIGH | This rule blocks executable files, such as .exe, .dll, or .scr, from launching. Thus, launching untrusted or unknown executable files can be risky, as it might not be initially clear if the files are malicious. Configuring this setting to Block also conforms to the benchmark. Note: Cloud-delivered protection must be enabled to use this rule. | Organizations may find implementing Block to be too strict, however in Audit mode there is still valuable information that can be logged for threat hunters to sift through and analyze. | None - manual attestation (documented review step) |
Ensure 'ASR: Block execution of potentially obfuscated scripts' is set to 'Audit' or higherwt.windows.defender.block-execution-of-potentially-obfuscated-scripts | HIGH | This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access. Creating malicious child processes is a common malware strategy. Malware that abuses Office as a vector often runs VBA macros and exploit code to download and attempt to run more payloads. However, some legitimate line-of-business applications might also generate child processes for benign purposes; such as spawning a command prompt or using PowerShell to configure registry settings. Configuring this setting to Block also conforms to the benchmark. | Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. | None - manual attestation (documented review step) |
Ensure 'ASR: Block JavaScript or VBScript from launching downloaded executable content' is set to 'Block'wt.windows.defender.block-javascript-or-vbscript-from-launching-downloaded-executable-content | HIGH | This rule prevents scripts from launching potentially malicious downloaded content. Malware written in JavaScript or VBScript often acts as a downloader to fetch and launch other malware from the Internet. Although not common, line-of-business applications sometimes use scripts to download and launch installers. | Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'ASR: Block Office applications from creating executable content' is set to 'Block'wt.windows.defender.block-office-applications-from-creating-executable-content | HIGH | This rule prevents scripts from launching potentially malicious downloaded content. Malware written in JavaScript or VBScript often acts as a downloader to fetch and launch other malware from the Internet. Although not common, line-of-business applications sometimes use scripts to download and launch installers. | Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'ASR: Block Office applications from injecting code into other processes' is set to 'Block'wt.windows.defender.block-office-applications-from-injecting-code-into-other-processes | HIGH | Attackers might attempt to use Office apps to migrate malicious code into other processes through code injection, so the code can masquerade as a clean process. There are no known legitimate business purposes for using code injection. This rule applies to Word, Excel, OneNote, and PowerPoint. | Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'ASR: Block Office communication application from creating child processes' is set to 'Audit' or higherwt.windows.defender.block-office-communication-application-from-creating-child-processes | HIGH | This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions. Configuring this setting to Block also conforms to the benchmark. | This ASR rule protects against social engineering attacks and prevents exploiting code from abusing vulnerabilities in Outlook. It also protects against Outlook rules and forms exploits that attackers can use when a user's credentials are compromised. | None - manual attestation (documented review step) |
Ensure 'ASR: Block persistence through WMI event subscription' is set to 'Block'wt.windows.defender.block-persistence-through-wmi-event-subscription | HIGH | This rule prevents malware from abusing WMI to attain persistence on a device. Note: If CcmExec.exe (SCCM Agent) is detected on the device, the ASR rule is classified as "not applicable" in Defender for Endpoint settings in the Microsoft Defender portal. | Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'ASR: Block process creations originating from PSExec and WMI commands' is set to 'Audit' or higherwt.windows.defender.block-process-creations-originating-from-psexec-and-wmi-commands | HIGH | This rule blocks processes created through PsExec and WMI from running. Both PsExec and WMI can remotely execute code. Configuring this setting to Block also conforms to the benchmark. | There's a risk of malware abusing functionality of PsExec and WMI for command and control purposes, or to spread an infection throughout an organization's network. | None - manual attestation (documented review step) |
Ensure 'ASR: Block untrusted and unsigned processes that run from USB' is set to 'Block'wt.windows.defender.block-untrusted-and-unsigned-processes-that-run-from-usb | HIGH | With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards. Blocked file types include executable files (such as .exe, .dll, or .scr) | Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'ASR: Block Win32 API calls from Office macros' is set to 'Block'wt.windows.defender.block-win32-api-calls-from-office-macros | HIGH | This rule prevents VBA macros from calling Win32 APIs. Office VBA enables Win32 API calls. | Malware can abuse VBA macro calls with various methods, such as calling Win32 APIs to launch malicious shellcode without writing anything directly to disk. Most organizations don't rely on the ability to call Win32 APIs in their day-to-day functioning, even if they use macros in other ways. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Days Until Aggressive Catchup Quick Scan' is set to '7 days' or fewerwt.windows.defender.days-until-aggressive-catchup-quick-scan | HIGH | This policy setting configures the number of days after the last scan (of any type) before an aggressive Quick Scan is automatically triggered. | Antivirus scans should be performed on a regular basis so that malicious software can be detected and remediated before malicious activity occurs. | None - manual attestation (documented review step) |
Ensure 'Enable Convert Warn To Block' is set to 'Warn verdicts are converted to block'wt.windows.defender.enable-convert-warn-to-block | MEDIUM | This policy setting controls whether Microsoft Defender Antivirus network protection will display a warning, or block network traffic. | Potentially suspicious network traffic should be blocked until it has been reviewed, and an exception has been granted. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable File Hash Computation' is set to 'Enable'wt.windows.defender.enable-file-hash-computation | MEDIUM | This setting determines whether hash values are computed for files scanned by Microsoft Defender. | When running an antivirus solution such as Microsoft Defender Antivirus, it is important to ensure that it is configured to monitor for suspicious and known malicious activity. File hashes are a reliable way of detecting changes to files, and can speed up the scan process by skipping files that have not changed since they were last scanned and determined to be safe. A changed file hash can also be cause for additional scrutiny. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Network Protection' is set to 'Enabled (block mode)'wt.windows.defender.enable-network-protection | HIGH | This policy setting controls Microsoft Defender Exploit Guard network protection. | This setting can help prevent employees from using any application to access dangerous domains that may host phishing scams, exploit-hosting sites, and other malicious content on the Internet. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Hide Exclusions From Local Users' is set to 'Enabled'wt.windows.defender.hide-exclusions-from-local-users | HIGH | This policy setting controls whether Microsoft Defender Antivirus exclusions are visible to local users on the system. . Note: As of the publication of this Benchmark, the setting configuration state in Intune is the sentence above after This was done to keep title length to a minimum. | Only administrators should be able to view and manage Microsoft Defender Antivirus exclusions. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Oobe Enable Rtp And Sig Update' is set to 'Enabled'wt.windows.defender.oobe-enable-rtp-and-sig-update | HIGH | This policy setting configures whether Real-time Protection and Security Intelligence Updates are enabled during the Out of Box experience (OOBE). . Note: As of the publication of this Benchmark, the setting configuration state in Intune is the sentence above after This was done to keep title length to a minimum. | Critical Windows zero-day patch updates should be applied during OOBE to help mitigate against malicious attacks. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'PUA Protection' is set to 'PUA Protection on'wt.windows.defender.pua-protection | HIGH | This policy setting controls detection and action for Potentially Unwanted Applications (PUA), which are sneaky unwanted application bundlers or their bundled applications, that can deliver adware or malware. For more information, see this link: Block potentially unwanted applications with Microsoft Defender Antivirus | Microsoft Docs | Potentially unwanted applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify, and can waste IT resources in cleaning up the applications. They should be blocked from installation. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Quick Scan Include Exclusions' is set to '1'wt.windows.defender.quick-scan-include-exclusions | HIGH | This policy setting manages whether or not Microsoft Defender Antivirus scans excluded files and directories when running a Quick Scan. Note: As of the publication of this Benchmark, the setting configuration state in Intune is the sentence above after This was done to keep title length to a minimum. | The Real-time Protection feature excludes some files and directories for contextual reasons. This setting ensures that these are scanned during a Quick Scan. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Remote Encryption Protection Aggressiveness' is set to 'Medium' or higherwt.windows.defender.remote-encryption-protection-aggressiveness | MEDIUM | This policy setting configures how aggressively Remote Encryption Prevention Protection blocks malicious IP addresses. Configuring this setting to High: Use cloud intel and context, and block when confidence level is above 90% also conforms to the benchmark. Note: As of the publication of this Benchmark, the setting configuration state in Intune is the sentence above after This was done to keep title length to a minimum. | This feature can help reduce the likelihood of users visiting malicious websites. | None - manual attestation (documented review step) |
Ensure 'Remote Encryption Protection Configured State' is set to 'Audit: Generate EDR detections without blocking' or higherwt.windows.defender.remote-encryption-protection-configured-state | HIGH | This policy setting configures the Brute-Force Protection feature in Microsoft Defender Antivirus. Brute-Force Protection can detect and block attempts to forcibly initiate sign- ins and sessions. Configuring this setting to Block: Prevent suspicious and malicious behaviors also conforms to the benchmark. Note: Configuring the value to either Default or Off does not conform to this benchmark. | This feature assists with mitigating brute force attempts by detecting and blocking unauthorized sign-ins and sessions. | None - manual attestation (documented review step) |
Ensure 'ASR: Use advanced protection against ransomware' is set to 'Audit' or higherwt.windows.defender.use-advanced-protection-against-ransomware | HIGH | This rule provides an extra layer of protection against ransomware. It uses both client and cloud heuristics to determine whether a file resembles ransomware. This rule doesn't block files that have one or more of the following characteristics: The file has already been found to be unharmful in the Microsoft cloud. The file is a valid signed file. The file is prevalent enough to not be considered as ransomware. The rule tends to err on the side of caution to prevent ransomware. Configuring this setting to Block also conforms to the benchmark. Note: Cloud-delivered protection must be enabled to use this rule. | This ASR rule is can help an organization enhance it's protection against ransomware by using both cloud and local heuristics. Note: Cloud-delivered protection must be enabled to use this rule. | None - manual attestation (documented review step) |
Ensure 'DO Download Mode' is NOT set to 'HTTP blended with Internet Peering'wt.windows.delivery-optimization.do-download-mode | HIGH | This policy setting specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps and App updates. The following methods are supported: • 0 = HTTP only, no peering. • 1 = HTTP blended with peering behind the same NAT. • 2 = HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if exist) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2. • 3 = HTTP blended with Internet Peering. • 99 = Simple download mode with no peering. Delivery Optimization downloads using HTTP only and does not attempt to contact the Delivery Optimization cloud services. • 100 = Bypass mode. Do not use Delivery Optimization and use BITS instead. Note: The default on all SKUs other than Enterprise, Enterprise LTSB or Education is Enabled: Internet (3), so on other SKUs, be sure to set this to a different value. | Due to privacy concerns and security risks, updates should only be downloaded directly from Microsoft, or from a trusted machine on the internal network that received its updates from a trusted source and approved by the network administrator. | None - manual attestation (documented review step) |
Ensure 'Enable App Installer Experimental Features' is set to 'Disabled'wt.windows.desktop-app-installer.enable-app-installer-experimental-features | HIGH | This policy setting controls whether users can enable experimental features in the Windows Package Manager. | Windows Package Manager is a command line tool can be used to discover, install, upgrade, remove and configure applications, and it can be used as a distribution channel for software packages containing tools and applications. Users should not have access to experimental features. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable App Installer Hash Override' is set to 'Disabled'wt.windows.desktop-app-installer.enable-app-installer-hash-override | HIGH | This policy setting controls whether or not users can override the SHA256 security validation in the Windows Package Manager settings. | Users should not have the ability to override SHA256 security validation. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable App Installer ms-appinstaller protocol' is set to 'Disabled'wt.windows.desktop-app-installer.enable-app-installer-ms-appinstaller-protocol | HIGH | This policy setting controls whether users can install packages from a website that is using the ms-appinstaller protocol. The ms-appinstaller protocol allows users to install an application by clicking a link on a website. | Users should not have the ability to install an application by clicking a link on a website. If an unknown or malicious link is clicked, malicious software could be installed on the system. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Do not allow COM port redirection' is set to 'Enabled'wt.windows.device-and-resource-redirection.do-not-allow-com-port-redirection | MEDIUM | This policy setting specifies whether to prevent the redirection of data to client COM ports from the remote computer in a Remote Desktop Services session. | In a more security-sensitive environment, it is desirable to reduce the possible attack surface. The need for COM port redirection within a Remote Desktop session is very rare, so makes sense to reduce the number of unexpected avenues for data exfiltration and/or malicious code transfer. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Do not allow drive redirection' is set to 'Enabled'wt.windows.device-and-resource-redirection.do-not-allow-drive-redirection | HIGH | This policy setting prevents users from sharing the local drives on their client computers to Remote Desktop Servers that they access. Mapped drives appear in the session folder tree in Windows Explorer in the following format: \TSClient<driveletter>$ If local drives are shared they are left vulnerable to intruders who want to exploit the data that is stored on them. | Data could be forwarded from the user's Remote Desktop Services session to the user's local computer without any direct user interaction. Malicious software already present on a compromised server would have direct and stealthy disk access to the user's local computer during the Remote Desktop session. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Do not allow LPT port redirection' is set to 'Enabled'wt.windows.device-and-resource-redirection.do-not-allow-lpt-port-redirection | MEDIUM | This policy setting specifies whether to prevent the redirection of data to client LPT ports during a Remote Desktop Services session. | In a more security-sensitive environment, it is desirable to reduce the possible attack surface. The need for LPT port redirection within a Remote Desktop session is very rare, so makes sense to reduce the number of unexpected avenues for data exfiltration and/or malicious code transfer. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Do not allow supported Plug and Play device redirection' is set to 'Enabled'wt.windows.device-and-resource-redirection.do-not-allow-supported-plug-and-play-device-redirection | MEDIUM | This policy setting allows you to control the redirection of supported Plug and Play devices, such as Windows Portable Devices, to the remote computer in a Remote Desktop Services session. | In a more security-sensitive environment, it is desirable to reduce the possible attack surface. The need for Plug and Play device redirection within a Remote Desktop session is very rare, so makes sense to reduce the number of unexpected avenues for data exfiltration and/or malicious code transfer. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Restrict clipboard transfer from server to client' is set to 'Enabled: Disable clipboard transfers from server to client'wt.windows.device-and-resource-redirection.restrict-clipboard-transfer-from-server-to-client | MEDIUM | This policy setting controls whether the clipboard can be used to transfer data from the Remote Desktop session to the client. | In a more security-sensitive environment, it is desirable to reduce the possible attack surface. The need for the clipboard to transfer data from a Remote Desktop session to a client is rare, so it makes sense to reduce the number of unexpected avenues for malicious activity to occur. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure System Guard Launch' is set to 'Unmanaged Enables Secure Launch if supported by hardware'wt.windows.device-guard.configure-system-guard-launch | HIGH | Secure Launch protects the Virtualization Based Security environment from exploited vulnerabilities in device firmware. Note: Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs. | Secure Launch changes the way Windows boots to use Intel Trusted Execution Technology (TXT) and Runtime BIOS Resilience features to prevent firmware exploits from being able to impact the security of the Windows Virtualization Based Security environment. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Credential Guard' is set to 'Enabled with UEFI lock'wt.windows.device-guard.credential-guard | HIGH | This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials. The "Enabled with UEFI lock" option ensures that Credential Guard cannot be disabled remotely. In order to disable the feature, you must set the Group Policy to "Disabled" as well as remove the security functionality from each computer, with a physically present user, in order to clear configuration persisted in UEFI. Note: Virtualization Based Security requires a 64-bit version of Windows with Secure Boot enabled, which in turn requires that Windows was installed with a UEFI BIOS configuration, not a Legacy BIOS configuration. In addition, if running Windows on a virtual machine, the hardware-assisted CPU virtualization feature (Intel VT-x or AMD-V) must be exposed by the host to the guest VM. More information on system requirements for this feature can be found at Windows Defender Credential Guard Requirements (Windows 10) | Microsoft Docs Note #2: Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs. | The Enabled with UEFI lock option ensures that Credential Guard cannot be disabled remotely. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Virtualization Based Security' is set to 'Enable virtualization based security'wt.windows.device-guard.enable-virtualization-based-security | HIGH | This policy setting specifies whether Virtualization Based Security is enabled. Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Note: Virtualization Based Security requires a 64-bit version of Windows with Secure Boot enabled, which in turn requires that Windows was installed with a UEFI BIOS configuration, not a Legacy BIOS configuration. In addition, if running Windows on a virtual machine, the hardware-assisted CPU virtualization feature (Intel VT-x or AMD-V) must be exposed by the host to the guest VM. More information on system requirements for this feature can be found at Windows Defender Credential Guard Requirements (Windows 10) | Microsoft Docs Note #2: Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs. | Kerberos, NTLM, and Credential manager isolate secrets by using virtualization-based security. Previous versions of Windows stored secrets in the Local Security Authority (LSA). Prior to Windows 10, the LSA stored secrets used by the operating system in its process memory. With Windows Defender Credential Guard enabled, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require Platform Security Features' is set to 'Turns on VBS with Secure Boot' or higherwt.windows.device-guard.require-platform-security-features | HIGH | This policy setting specifies whether Virtualization Based Security (VBS) is enabled. VBS uses the Windows Hypervisor to provide support for security services. DMA requires hardware support. Note: VBS requires a 64-bit version of Windows with Secure Boot enabled, which in turn requires that Windows was installed with a UEFI BIOS configuration, not a Legacy BIOS configuration. In addition, if running Windows on a virtual machine, the hardware- assisted CPU virtualization feature (Intel VT-x or AMD-V) must be exposed by the host to the guest VM. More information on system requirements for this feature can be found at Windows Defender Credential Guard Requirements (Windows 10) | Microsoft Docs Note #2: Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs. | Secure Boot can help reduce the risk of bootloader attacks and in conjunction with DMA protections to help protect data from being scraped from memory. | None - manual attestation (documented review step) |
Ensure 'Prevent installation of devices using drivers that match these device setup classes' is set to 'Enabled'wt.windows.device-installation-restrictions.prevent-installation-of-devices-using-drivers-that-match-these-device-setup-classes | HIGH | This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. If you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings. | A BitLocker-protected computer may be vulnerable to Direct Memory Access (DMA) attacks when the computer is turned on or is in the Standby power state - this includes when the workstation is locked. BitLocker with TPM-only authentication lets a computer enter the power-on state without any pre-boot authentication. Therefore, an attacker may be able to perform DMA attacks. This issue is documented in Microsoft Knowledge Base article 2516445: Blocking the SBP-2 driver and Thunderbolt controllers to reduce 1394 DMA and Thunderbolt DMA threats to BitLocker. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Prevent installation of devices using drivers that match these device setup classes: Also apply to matching devices that are already installed.' is set to 'True' (checked)wt.windows.device-installation-restrictions.prevent-installation-of-devices-using-drivers-that-match-these-device-setup-classes-4-10-9-1-2 | HIGH | This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. If you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings. | A BitLocker-protected computer may be vulnerable to Direct Memory Access (DMA) attacks when the computer is turned on or is in the Standby power state - this includes when the workstation is locked. BitLocker with TPM-only authentication lets a computer enter the power-on state without any pre-boot authentication. Therefore, an attacker may be able to perform DMA attacks. This issue is documented in Microsoft Knowledge Base article 2516445: Blocking the SBP-2 driver and Thunderbolt controllers to reduce 1394 DMA and Thunderbolt DMA threats to BitLocker. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Prevent installation of devices using drivers that match these device setup classes: Prevent installation of devices using drivers for these device setup' is set to 'IEEE 1394 device setup classes'wt.windows.device-installation-restrictions.prevent-installation-of-devices-using-drivers-that-match-these-device-setup-classes-4-10-9-1-3 | HIGH | This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. If you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings. Here are the four entries we recommend and what they translate to: • {d48179be-ec20-11d1-b6b8-00c04fa372a7} - IEEE 1394 devices that support the SBP2 Protocol Class • {7ebefbc0-3200-11d2-b4c2-00a0C9697d07} - IEEE 1394 devices that support the IEC-61883 Protocol Class • {c06ff265-ae09-48f0-812c-16753d7cba83} - IEEE 1394 devices that support the AVC Protocol Class • {6bdd1fc1-810f-11d0-bec7-08002be2092f} - IEEE 1394 Host Bus Controller Class The full list of system-defined device setup classes available in Windows is here: System-Defined Device Setup Classes Available to Vendors | Microsoft Docs LINK (by Sony) and Lynx (by Texas Instruments). | A BitLocker-protected computer may be vulnerable to Direct Memory Access (DMA) attacks when the computer is turned on or is in the Standby power state - this includes when the workstation is locked. BitLocker with TPM-only authentication lets a computer enter the power-on state without any pre-boot authentication. Therefore, an attacker may be able to perform DMA attacks. This issue is documented in Microsoft Knowledge Base article 2516445: Blocking the SBP-2 driver and Thunderbolt controllers to reduce 1394 DMA and Thunderbolt DMA threats to BitLocker. | None - manual attestation (documented review step) |
Ensure 'Prevent device metadata retrieval from the Internet' is set to 'Enabled'wt.windows.device-installation.prevent-device-metadata-retrieval-from-the-internet | HIGH | This policy setting allows you to prevent Windows from retrieving device metadata from the Internet. Note: This will not prevent the installation of basic hardware drivers, but does prevent associated third-party utility software from automatically being installed under the context of the SYSTEM account. | Installation of software should be conducted by an authorized system administrator and not a standard user. Allowing automatic third-party software installations under the context of the SYSTEM account has potential for allowing unauthorized access via backdoors or installation software bugs. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Device Password Enabled' is set to 'Enabled'wt.windows.device-lock.device-password-enabled | HIGH | This policy setting specifics whether device lock is enabled. when enabled, the following policy settings take effect on the system which are included in the Device Lock Section: • AllowSimpleDevicePassword • MinDevicePasswordLength • AlphanumericDevicePasswordRequired • MaxDevicePasswordFailedAttempts • MaxInactivityTimeDeviceLock • MinDevicePasswordComplexCharacters | This policy setting allows for the configuration of settings such as those contained in the password and device lock policy. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Device Password Enabled: Alphanumeric Device Password Required' is set to 'Password or Alphanumeric PIN required'wt.windows.device-lock.device-password-enabled-alphanumeric-device-password-required | HIGH | This policy setting determines the type of PIN or password this is required on a system. Note: This policy only applies if the DevicePasswordEnabled policy is set to 1. This is a pre-requisite for Alphanumeric Device Password Required in the settings catalog. | This is a pre-requisite for Min Device Password Complex Characters, which enforces a more complex local user and Microsoft account passwords. Note: This setting has no impact on Entra ID accounts. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Device Password Enabled: Min Device Password Complex Characters' is set to 'Digits and lowercase letters are required'wt.windows.device-lock.device-password-enabled-alphanumeric-device-password-required-min-device-password-complex-characters | HIGH | This policy setting configures the number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for PIN or password. A complexity value of 3 or 4 is unsupported and setting this value on the server makes Microsoft accounts non-compliant. However, configuring this setting to 2 will force the value of 3 for Local accounts. | Passwords should contain complexity to ensure they are not easily guessed or brute- forced by a malicious actor. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Device Password Enabled: Device Password Expiration' is set to '365 or fewer days, but not 0'wt.windows.device-lock.device-password-enabled-device-password-expiration | HIGH | This policy setting defines how long a user can use their password before it expires. Note: Values for this policy setting range from 0 to 730 days. If this policy is set to the value 0, the password will never expire. | The longer a password exists the higher the likelihood that it will be compromised by a brute force attack, by an attacker gaining general knowledge about the user, or by the user sharing the password. Configuring the Maximum password age setting to 0 so that users are never required to change their passwords is a major security risk because that allows a compromised password to be used by the malicious user for as long as the valid user has authorized access. Because attackers can crack passwords, the more frequently you change the password the less opportunity an attacker has to use a cracked password. However, the lower this value is set, the higher the potential for an increase in calls to help desk support due to users having to change their password or forgetting which password is current. | None - manual attestation (documented review step) |
Ensure 'Device Password Enabled: Device Password History' is set to '24 or more password(s)'wt.windows.device-lock.device-password-enabled-device-password-history | HIGH | This policy setting determines the number of renewed, unique passwords that have to be associated with a user account before you can reuse an old password. In an Intune managed environment this setting applies to local user accounts and not Entra ID accounts. The value includes the user's current password. This value denotes that with a setting of 1, the user can't reuse their current password when choosing a new password, while a setting of 5 means that a user can't set their new password to their current password or any of their previous four passwords. | The longer a user uses the same password, the greater the chance that an attacker can determine the password through brute force attacks. Also, any accounts that may have been compromised will remain exploitable for as long as the password is left unchanged. If password changes are required but password reuse is not prevented, or if users continually reuse a small number of passwords, the effectiveness of a good password policy is greatly reduced. If you specify a low number for this policy setting, users will be able to use the same small number of passwords repeatedly. If you do not also configure the Minimum password age setting, users might repeatedly change their passwords until they can reuse their original password. | None - manual attestation (documented review step) |
Ensure 'Device Password Enabled: Max Device Password Failed Attempts' is set to '5 or fewer failed attempt(s), but not 0'wt.windows.device-lock.device-password-enabled-max-device-password-failed-attempts | HIGH | This policy setting determines the number of failed logon attempts before the account is locked. Setting this policy to 0 does not conform to the benchmark as doing so disables the account lockout threshold. Note: When a user reaches the value set by this policy, the system is not wiped, instead the system will be in BitLocker recovery mode, which makes data inaccessible but recoverable. If BitLocker is not enabled, then this policy will not be enforced. | Setting an account lockout threshold reduces the likelihood that an online password brute force attack will be successful. Setting the account lockout threshold too low introduces risk of increased accidental lockouts and/or a malicious actor intentionally locking out accounts. | None - manual attestation (documented review step) |
Ensure 'Device Password Enabled: Max Inactivity Time Device Lock' is set to '15 or fewer minutes, but not 0'wt.windows.device-lock.device-password-enabled-max-inactivity-time-device-lock | HIGH | Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session. Note: A value of 0 does not conform to the benchmark as it disables the machine inactivity limit. | If a user forgets to lock their computer when they walk away it's possible that a passerby will hijack it. | None - manual attestation (documented review step) |
Ensure 'Device Password Enabled: Min Device Password Length' is set to '14 or more character(s)'wt.windows.device-lock.device-password-enabled-min-device-password-length | HIGH | This policy setting determines the least number of characters that make up a password for a local user account. There are many different theories about how to determine the best password length for an organization, but perhaps "passphrase" is a better term than "password." In Microsoft Windows 2000 or newer, passphrases can be quite long and can include spaces. Therefore, a phrase such as "I want to drink a $5 milkshake" is a valid passphrase; it is a considerably stronger password than an 8 or 10 character string of random numbers and letters, and yet is easier to remember. Users must be educated about the proper selection and maintenance of passwords, especially around password length. In enterprise environments, the ideal value for the Minimum password length setting is 14 characters, however you should adjust this value to meet your organization's business requirements. | Types of password attacks include dictionary attacks (which attempt to use common words and phrases) and brute force attacks (which try every possible combination of characters). Also, attackers sometimes try to obtain the account database so they can use tools to discover the accounts and passwords. | None - manual attestation (documented review step) |
Ensure 'Minimum Password Age' is set to '1 or more day(s)'wt.windows.device-lock.minimum-password-age | HIGH | This security setting determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 998 days, or you can allow changes immediately by setting the number of days to 0. | Users may have favorite passwords that they like to use because they are easy to remember and they believe that their password choice is secure from compromise. Unfortunately, passwords are compromised and if an attacker is targeting a specific individual's user account, with foreknowledge of data about that user, reuse of old passwords can cause a security breach. To address password reuse a combination of security settings is required. Using this policy setting with the Enforce password history setting prevents the easy reuse of old passwords. For example, if you configure the Enforce password history setting to ensure that users cannot reuse any of their last 12 passwords, they could change their password 13 times in a few minutes and reuse the password they started with, unless you also configure the Minimum password age setting to a number that is greater than 0. You must configure this policy setting to a number that is greater than 0 for the Enforce password history setting to be effective. | None - manual attestation (documented review step) |
Ensure 'Device Enumeration Policy' is set to 'Block all (most restrictive)'wt.windows.dma-guard.device-enumeration-policy | HIGH | This policy is intended to provide additional security against external DMA-capable devices. It allows for more control over the enumeration of external DMA-capable devices that are not compatible with DMA Remapping/device memory isolation and sandboxing. Note: This policy does not apply to 1394, PCMCIA or ExpressCard devices. The protection also only applies to Windows 10 R1803 or higher and requires a UEFI BIOS to function. Note #2: More information on this feature is available at this link: Kernel DMA Protection for Thunderbolt™ 3 (Windows 10) | Microsoft Docs. | Device memory sandboxing allows the OS to leverage the I/O Memory Management Unit (IOMMU) of a device to block unpermitted I/O, or memory access, by the peripheral. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off multicast name resolution' is set to 'Enabled'wt.windows.dns-client.turn-off-multicast-name-resolution | HIGH | Link-Local Multicast Name Resolution (LLMNR) is a secondary name resolution protocol. With LLMNR, queries are sent using multicast over a local network link on a single subnet from a client computer to another client computer on the same subnet that also has LLMNR enabled. LLMNR does not require a DNS server or DNS client configuration and provides name resolution in scenarios in which conventional DNS name resolution is not possible. | An attacker can listen on a network for these LLMNR (UDP/5355) or NBT-NS (UDP/137) broadcasts and respond to them, tricking the host into thinking that it knows the location of the requested system. Note: To completely mitigate local name resolution poisoning, in addition to this setting, the properties of each installed NIC should also be set to Disable NetBIOS over TCP/IP (on the WINS tab in the NIC properties). Unfortunately, there is no global setting to achieve this that automatically applies to all NICs - it is a per-NIC setting that varies with different NIC hardware installations. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Boot-Start Driver Initialization Policy' is set to 'Enabled: Good, unknown and bad but critical'wt.windows.early-launch-antimalware.boot-start-driver-initialization-policy | HIGH | This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver: • Good: The driver has been signed and has not been tampered with. • Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized. • Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver. • Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot- start driver. If you enable this policy setting you will be able to choose which boot-start drivers to initialize the next time the computer is started. If your malware detection application does not include an Early Launch Antimalware boot-start driver or if your Early Launch Antimalware boot-start driver has been disabled, this setting has no effect and all boot-start drivers are initialized. | This policy setting helps reduce the impact of malware that has already infected your system. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Notify Malicious' is set to 'Enabled'wt.windows.enhanced-phishing-protection.notify-malicious | HIGH | This policy setting determines whether Enhanced Phishing Protection in Microsoft Defender SmartScreen warns users if they type their work or school password into one of the following malicious scenarios: into a reported phishing site, into a Microsoft login URL with an invalid certificate, or into an application connecting to either a reported phishing site or a Microsoft login URL with an invalid certificate. Note: This setting only applies to Microsoft Accounts (computer or browser login) while using Microsoft Windows 11 and not on-prem domain-joined accounts. | Users will receive a pop-up notification if they try to access a website that is being blocked by Windows Defender SmartScreen. This assists users in making informed decisions about why the website is being blocked and whether to continue to it. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Notify Password Reuse' is set to 'Enabled'wt.windows.enhanced-phishing-protection.notify-password-reuse | HIGH | This policy setting determines whether Enhanced Phishing Protection in Microsoft Defender SmartScreen warns users if they reuse their work or school password. Note: This setting only applies to Microsoft Accounts (computer or browser login) while using Microsoft Windows 11 and not on prem domain-joined accounts. | Users will be alerted if they try to use a password that has been exposed in a known data breach. This can help reduce the risk of password-related security incidents, such as unauthorized access to online accounts, and can encourage users to choose strong and unique passwords. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Notify Unsafe App' is set to 'Enabled'wt.windows.enhanced-phishing-protection.notify-unsafe-app | HIGH | This policy setting determines whether Enhanced Phishing Protection in Microsoft Defender SmartScreen warns users if they type their work or school passwords in Notepad, WordPad, or M365 Office apps like OneNote, Word, Excel, etc. Note: This setting only applies to Microsoft Accounts (computer or browser login) while using Microsoft Windows 11 and not on prem domain-joined accounts. | Users will be warned if they store their password in Notepad or Microsoft 365 Office Apps. This can help reduce the risk of security incidents, such as data theft or data loss. Storing credentials in plain text allows for anyone who has authorized or unauthorized access to the system to obtain them. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Service Enabled' is set to 'Enabled'wt.windows.enhanced-phishing-protection.service-enabled | HIGH | This policy setting determines whether Enhanced Phishing Protection is in audit mode. This allows notifications to be sent to users regarding unsafe password events. Additionally, Enhanced Phishing Protection captures unsafe password entry events and sends diagnostic data through Microsoft Defender. Note: This setting only applies to Microsoft accounts (computer or browser login) while using Microsoft Windows 11 and not on-prem domain-joined accounts. | Allowing Enhanced Phishing Protection the ability to warn users about unsafe password use could prevent phishing attempts and (credential) data loss. In addition, the Microsoft 365 Defender Portal provides valuable phishing sensor data found in the environment. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Cortana' is set to 'Block' (Automated)wt.windows.experience.allow-cortana | HIGH | This policy setting specifies whether Cortana is allowed on the device. | If Cortana is enabled, sensitive information could be contained in search history and sent out to Microsoft. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Spotlight Collection (User)' is set to '0'wt.windows.experience.allow-spotlight-collection-user | HIGH | This policy setting removes the Spotlight collection setting in Personalization, rendering the user unable to select and subsequently download daily images from Microsoft to the system desktop. | Disabling this setting will help ensure your data is not shared with any third party. The Windows Spotlight feature collects data and uses that data to display images from Microsoft. | None - manual attestation (documented review step) |
Ensure 'Allow Windows Spotlight (User)' is set to 'Block'wt.windows.experience.allow-windows-spotlight-user | MEDIUM | This policy setting determines whether the all Windows Spotlight features are turned on/off (together). Note: Per Microsoft TechNet, this policy setting only applies to Windows 10 Enterprise and Windows 10 Education editions. Note #2: Setting this recommendation to Block also disables the Recommendation Allow Tailored Experiences With Diagnostic Data which was is included in the on- prem Workstation Benchmarks. It was not included in the Intune version since this setting is automatically disabled. | Disabling this setting will help ensure your data is not shared with any third party. The Windows Spotlight feature collects data and uses that data to display suggested apps as well as images from the internet. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Disable Consumer Account State Content' is set to 'Enabled'wt.windows.experience.disable-consumer-account-state-content | HIGH | This policy setting determines whether cloud consumer account state content is allowed in all Windows experiences. | The use of consumer accounts in an enterprise managed environment is not good security practice as it could lead to possible data leakage. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Do not show feedback notifications' is set to 'Feedback notifications are disabled'wt.windows.experience.do-not-show-feedback-notifications | HIGH | This policy setting allows an organization to prevent its devices from showing feedback questions from Microsoft. | Users should not be sending any feedback to third-party vendors in an enterprise managed environment. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure Windows Defender SmartScreen' is set to 'Enabled: Warn and prevent bypass'wt.windows.file-explorer.configure-windows-defender-smartscreen | HIGH | This policy setting allows you to manage the behavior of Windows Defender SmartScreen. Windows Defender SmartScreen helps keep PCs safer by warning users before running unrecognized programs downloaded from the Internet. Some information is sent to Microsoft about files and programs run on PCs with this feature enabled. | Windows Defender SmartScreen helps keep PCs safer by warning users before running unrecognized programs downloaded from the Internet. However, due to the fact that some information is sent to Microsoft about files and programs run on PCs some organizations may prefer to disable it. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off Data Execution Prevention for Explorer' is set to 'Disabled'wt.windows.file-explorer.turn-off-data-execution-prevention-for-explorer | HIGH | Disabling Data Execution Prevention can allow certain legacy plug-in applications to function without terminating Explorer. Note: Some legacy plug-in applications and other software may not function with Data Execution Prevention and will require an exception to be defined for that specific plug- in/software. | Data Execution Prevention is an important security feature supported by Explorer that helps to limit the impact of certain types of malware. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off heap termination on corruption' is set to 'Disabled'wt.windows.file-explorer.turn-off-heap-termination-on-corruption | HIGH | Without heap termination on corruption, legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Ensuring that heap termination on corruption is active will prevent this. | Allowing an application to function after its session has become corrupt increases the risk posture to the system. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off shell protocol protected mode' is set to 'Disabled'wt.windows.file-explorer.turn-off-shell-protocol-protected-mode | HIGH | This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functionality of this protocol, applications can open folders and launch files. The protected mode reduces the functionality of this protocol allowing applications to only open a limited set of folders. Applications are not able to open files with this protocol when it is in the protected mode. It is recommended to leave this protocol in the protected mode to increase the security of Windows. | Limiting the opening of files and folders to a limited set reduces the attack surface of the system. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Domain Network Firewall' is set to 'True'wt.windows.firewall.enable-domain-network-firewall | HIGH | Select True (recommended) to have Windows Firewall with Advanced Security use the settings for this profile to filter network traffic. If you select False, Windows Firewall with Advanced Security will not use any of the firewall rules or connection security rules for this profile. | If the firewall is turned off all traffic will be able to access the system and an attacker may be more easily able to remotely exploit a weakness in a network service. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Domain Network Firewall: Default Inbound Action for Domain Profile' is set to 'Block'wt.windows.firewall.enable-domain-network-firewall-default-inbound-action-for-domain-profile | HIGH | This setting determines the behavior for inbound connections that do not match an inbound firewall rule. | If the firewall allows all traffic to access the system then an attacker may be more easily able to remotely exploit a weakness in a network service. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Domain Network Firewall: Disable Inbound Notifications' is set to 'True'wt.windows.firewall.enable-domain-network-firewall-disable-inbound-notifications | HIGH | Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections. Note: When the Apply local firewall rules setting is configured to No, it's recommended to also configure the Display a notification setting to No. Otherwise, users will continue to receive messages that ask if they want to unblock a restricted inbound connection, but the user's response will be ignored. | Firewall notifications can be complex and may confuse the end users, who would not be able to address the alert. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Domain Network Firewall: Enable Log Dropped Packets' is set to 'Yes: Enable Logging Of Dropped Packets'wt.windows.firewall.enable-domain-network-firewall-enable-log-dropped-packets | HIGH | Use this option to log when Windows Firewall with Advanced Security discards an inbound packet for any reason. The log records why and when the packet was dropped. Look for entries with the word DROP in the action column of the log. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Domain Network Firewall: Enable Log Success Connections' is set to 'Enable Logging Of Successful Connections'wt.windows.firewall.enable-domain-network-firewall-enable-log-success-connections | HIGH | Use this option to log when Windows Firewall with Advanced Security allows an inbound connection. The log records why and when the connection was formed. Look for entries with the word ALLOW in the action column of the log. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Domain Network Firewall: Log File Path' is set to '%SystemRoot%\System32\logfiles\firewall\domainfw.log'wt.windows.firewall.enable-domain-network-firewall-log-file-path | HIGH | Use this option to specify the path and name of the file in which Windows Firewall will write its log information. log. | If Windows Firewall events are not recorded it may be difficult or impossible for Administrators to analyze system issues or unauthorized activities of malicious users. Microsoft stores all firewall events as one file on the system (pfirewall.log). To improve logging, separate each firewall profile (domain, private, public) into its own distinct log file (domainfw.log, privatefw.log, publicfw.log) for better organization and identification of specific issues within each profile. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Domain Network Firewall: Log Max File Size' is set to '16,384 KB or greater'wt.windows.firewall.enable-domain-network-firewall-log-max-file-size-kb | HIGH | Use this option to specify the size limit of the file in which Windows Firewall will write its log information. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users. | None - manual attestation (documented review step) |
Ensure 'Enable Private Network Firewall' is set to 'True'wt.windows.firewall.enable-private-network-firewall | HIGH | Select True (recommended) to have Windows Firewall with Advanced Security use the settings for this profile to filter network traffic. If you select False, Windows Firewall with Advanced Security will not use any of the firewall rules or connection security rules for this profile. | If the firewall is turned off all traffic will be able to access the system and an attacker may be more easily able to remotely exploit a weakness in a network service. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Private Network Firewall: Default Inbound Action for Private Profile' is set to 'Block'wt.windows.firewall.enable-private-network-firewall-default-inbound-action-for-private-profile | HIGH | This setting determines the behavior for inbound connections that do not match an inbound firewall rule. | If the firewall allows all traffic to access the system then an attacker may be more easily able to remotely exploit a weakness in a network service. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Private Network Firewall: Disable Inbound Notifications' is set to 'True'wt.windows.firewall.enable-private-network-firewall-disable-inbound-notifications | HIGH | Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections. Note: When the Apply local firewall rules setting is configured to No, it's recommended to also configure the Display a notification setting to No. Otherwise, users will continue to receive messages that ask if they want to unblock a restricted inbound connection, but the user's response will be ignored. | Firewall notifications can be complex and may confuse the end users, who would not be able to address the alert. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Private Network Firewall: Enable Log Dropped Packets' is set to 'Yes: Enable Logging Of Dropped Packets'wt.windows.firewall.enable-private-network-firewall-enable-log-dropped-packets | HIGH | Use this option to log when Windows Firewall with Advanced Security discards an inbound packet for any reason. The log records why and when the packet was dropped. Look for entries with the word DROP in the action column of the log. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Private Network Firewall: Enable Log Success Connections' is set to 'Enable Logging Of Successful Connections'wt.windows.firewall.enable-private-network-firewall-enable-log-success-connections | HIGH | Use this option to log when Windows Firewall with Advanced Security allows an inbound connection. The log records why and when the connection was formed. Look for entries with the word ALLOW in the action column of the log. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Private Network Firewall: Log File Path' is set to '%SystemRoot%\System32\logfiles\firewall\privatefw.log'wt.windows.firewall.enable-private-network-firewall-log-file-path | HIGH | Use this option to specify the path and name of the file in which Windows Firewall will write its log information. log. | If Windows Firewall events are not recorded it may be difficult or impossible for Administrators to analyze system issues or unauthorized activities of malicious users. Microsoft stores all firewall events as one file on the system (pfirewall.log). To improve logging, separate each firewall profile (domain, private, public) into its own distinct log file (domainfw.log, privatefw.log, publicfw.log) for better organization and identification of specific issues within each profile. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Private Network Firewall: Log Max File Size' is set to '16,384 KB or greater'wt.windows.firewall.enable-private-network-firewall-log-max-file-size-kb | HIGH | Use this option to specify the size limit of the file in which Windows Firewall will write its log information. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users. | None - manual attestation (documented review step) |
Ensure 'Enable Public Network Firewall' is set to 'True'wt.windows.firewall.enable-public-network-firewall | HIGH | Select True (recommended) to have Windows Firewall with Advanced Security use the settings for this profile to filter network traffic. If you select False, Windows Firewall with Advanced Security will not use any of the firewall rules or connection security rules for this profile. | If the firewall is turned off all traffic will be able to access the system and an attacker may be more easily able to remotely exploit a weakness in a network service. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Public Network Firewall: Allow Local Ipsec Policy Merge' is set to 'False'wt.windows.firewall.enable-public-network-firewall-allow-local-ipsec-policy-merge | HIGH | This setting controls whether local administrators are allowed to create connection security rules that apply together with connection security rules configured by Group Policy. | Users with administrative privileges might create firewall rules that expose the system to remote attack. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Public Network Firewall: Allow Local Policy Merge' is set to 'False'wt.windows.firewall.enable-public-network-firewall-allow-local-policy-merge | HIGH | This setting controls whether local administrators are allowed to create local firewall rules that apply together with firewall rules configured by Group Policy. Note: When the Allow Local Policy Merge setting is configured to False, it's recommended to also configure the Disable Inbound Notifications setting to True. Otherwise, users will continue to receive messages that ask if they want to unblock a restricted inbound connection, but the user's response will be ignored. | When in the Public profile, there should be no special local firewall exceptions per computer. These settings should be managed by a centralized policy. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Public Network Firewall: Default Inbound Action for Public Profile' is set to 'Block'wt.windows.firewall.enable-public-network-firewall-default-inbound-action-for-public-profile | HIGH | This setting determines the behavior for inbound connections that do not match an inbound firewall rule. | If the firewall allows all traffic to access the system then an attacker may be more easily able to remotely exploit a weakness in a network service. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Public Network Firewall: Disable Inbound Notifications' is set to 'True'wt.windows.firewall.enable-public-network-firewall-disable-inbound-notifications | HIGH | Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections. | Some organizations may prefer to avoid alarming users when firewall rules block certain types of network activity. However, notifications can be helpful when troubleshooting network issues involving the firewall. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Public Network Firewall: Enable Log Dropped Packets' is set to 'Yes: Enable Logging Of Dropped Packets'wt.windows.firewall.enable-public-network-firewall-enable-log-dropped-packets | HIGH | Use this option to log when Windows Firewall with Advanced Security discards an inbound packet for any reason. The log records why and when the packet was dropped. Look for entries with the word DROP in the action column of the log. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Public Network Firewall: Enable Log Success Connections' is set to 'Enable Logging Of Successful Connections'wt.windows.firewall.enable-public-network-firewall-enable-log-success-connections | HIGH | Use this option to log when Windows Firewall with Advanced Security allows an inbound connection. The log records why and when the connection was formed. Look for entries with the word ALLOW in the action column of the log. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Public Network Firewall: Log File Path' is set to '%SystemRoot%\System32\logfiles\firewall\publicfw.log'wt.windows.firewall.enable-public-network-firewall-log-file-path | HIGH | Use this option to specify the path and name of the file in which Windows Firewall will write its log information. log. | If Windows Firewall events are not recorded it may be difficult or impossible for Administrators to analyze system issues or unauthorized activities of malicious users. Microsoft stores all firewall events as one file on the system (pfirewall.log). To improve logging, separate each firewall profile (domain, private, public) into its own distinct log file (domainfw.log, privatefw.log, publicfw.log) for better organization and identification of specific issues within each profile. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Public Network Firewall: Log Max File Size' is set to '16,384 KB or greater'wt.windows.firewall.enable-public-network-firewall-log-max-file-size-kb | HIGH | Use this option to specify the size limit of the file in which Windows Firewall will write its log information. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users. | None - manual attestation (documented review step) |
Ensure 'Choose how BitLocker-protected fixed drives can be recovered' is set to 'Enabled'wt.windows.fixed-data-drives.choose-how-bitlocker-protected-fixed-drives-can-be-recovered | HIGH | This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. The "Allow data recovery agent" check box is used to specify whether a Data Recovery Agent can be used with BitLocker-protected fixed data drives. Before a Data Recovery Agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding Data Recovery Agents. In "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. Select "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. In "Save BitLocker recovery information to Active Directory Domain Services" choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only", only the recovery password is stored in AD DS. Select the "Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. Note: If the "Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives" check box is selected, a recovery password is automatically generated. | Administrators should always have a safe, secure way to access encrypted data in the event users cannot access their data. Additionally, as with any authentication method, a drive can be compromised by guessing or finding the authentication information used to access the drive. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent' is set to 'Enabled: True'wt.windows.fixed-data-drives.choose-how-bitlocker-protected-fixed-drives-can-be-recovered-allow-data-recovery-agent | HIGH | This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. The "Allow data recovery agent" check box is used to specify whether a Data Recovery Agent can be used with BitLocker-protected fixed data drives. Before a Data Recovery Agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding Data Recovery Agents. | Administrators should always have a safe, secure way to access encrypted data in the event users cannot access their data. Additionally, as with any authentication method, a drive can be compromised by guessing or finding the authentication information used to access the drive. To use BitLocker, a Data Recovery Agent will need to be configured for fixed drives. To recover a drive will require highly-controlled access to the Data Recovery Agent private key. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS' is set to 'Enabled: Backup recovery passwords and key packages'wt.windows.fixed-data-drives.choose-how-bitlocker-protected-fixed-drives-can-be-recovered-configure-storage-of-bitlocker-recovery-information-to-ad-ds | HIGH | This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. In "Save BitLocker recovery information to Active Directory Domain Services" choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only", only the recovery password is stored in AD DS. | Administrators should always have a safe, secure way to access encrypted data in the event users cannot access their data. Additionally, as with any authentication method, a drive can be compromised by guessing or finding the authentication information used to access the drive. To use BitLocker, a Data Recovery Agent will need to be configured for fixed drives. To recover a drive will require highly-controlled access to the Data Recovery Agent private key. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives' is set to 'Enabled: False'wt.windows.fixed-data-drives.choose-how-bitlocker-protected-fixed-drives-can-be-recovered-do-not-enable-bitlocker-until-recovery-information-is-stored-to-ad-ds-for-fixed-data-drives | HIGH | This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. Select the "Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. Note: If the "Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives" check box is selected, a recovery password is automatically generated. | Administrators should always have a safe, secure way to access encrypted data in the event users cannot access their data. Additionally, as with any authentication method, a drive can be compromised by guessing or finding the authentication information used to access the drive. To use BitLocker, a Data Recovery Agent will need to be configured for fixed drives. To recover a drive will require highly-controlled access to the Data Recovery Agent private key. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard' is set to 'Enabled: True'wt.windows.fixed-data-drives.choose-how-bitlocker-protected-fixed-drives-can-be-recovered-omit-recovery-options-from-the-bitlocker-setup-wizard | HIGH | This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. Select "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. | Administrators should always have a safe, secure way to access encrypted data in the event users cannot access their data. Additionally, as with any authentication method, a drive can be compromised by guessing or finding the authentication information used to access the drive. To use BitLocker, a Data Recovery Agent will need to be configured for fixed drives. To recover a drive will require highly-controlled access to the Data Recovery Agent private key. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Recovery Key' is set to 'Enabled: Allow 256-bit recovery key'wt.windows.fixed-data-drives.choose-how-bitlocker-protected-fixed-drives-can-be-recovered-recovery-key | HIGH | This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. In "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. | Administrators should always have a safe, secure way to access encrypted data in the event users cannot access their data. Additionally, as with any authentication method, a drive can be compromised by guessing or finding the authentication information used to access the drive. To use BitLocker, a Data Recovery Agent will need to be configured for fixed drives. To recover a drive will require highly-controlled access to the Data Recovery Agent private key. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Recovery Password' is set to 'Enabled: Allow 48-digit recovery password'wt.windows.fixed-data-drives.choose-how-bitlocker-protected-fixed-drives-can-be-recovered-recovery-password | HIGH | This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. In "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. | Administrators should always have a safe, secure way to access encrypted data in the event users cannot access their data. Additionally, as with any authentication method, a drive can be compromised by guessing or finding the authentication information used to access the drive. To use BitLocker, a Data Recovery Agent will need to be configured for fixed drives. To recover a drive will require highly-controlled access to the Data Recovery Agent private key. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives' is set to 'Enabled: False'wt.windows.fixed-data-drives.choose-how-bitlocker-protected-fixed-drives-can-be-recovered-save-bitlocker-recovery-information-to-ad-ds-for-fixed-data-drives | HIGH | This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. In "Save BitLocker recovery information to Active Directory Domain Services" choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only", only the recovery password is stored in AD DS. | Administrators should always have a safe, secure way to access encrypted data in the event users cannot access their data. Additionally, as with any authentication method, a drive can be compromised by guessing or finding the authentication information used to access the drive. To use BitLocker, a Data Recovery Agent will need to be configured for fixed drives. To recover a drive will require highly-controlled access to the Data Recovery Agent private key. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Continue experiences on this device' is set to 'Disabled'wt.windows.group-policy.continue-experiences-on-this-device | HIGH | This policy setting determines whether the Windows device is allowed to participate in cross-device experiences (continue experiences). | A cross-device experience is when a system can access app and send messages to other devices. In an enterprise managed environment only trusted systems should be communicating within the network. Access to any other system should be prohibited. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off background refresh of Group Policy' is set to 'Disabled'wt.windows.group-policy.turn-off-background-refresh-of-group | HIGH | This policy setting prevents Group Policy from being updated while the computer is in use. This policy setting applies to Group Policy for computers, users and Domain Controllers. | This setting ensures that group policy changes take effect more quickly, as compared to waiting until the next user logon or system restart. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off access to the Store' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-access-to-the-store | MEDIUM | This policy setting specifies whether to use the Store service for finding an application to open a file with an unhandled file type or protocol association. When a user opens a file type or protocol that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Store service to find an application. | The Store service is a retail outlet built into Windows, primarily for consumer use. In an enterprise managed environment the IT department should be managing the installation of all applications to reduce the risk of the installation of vulnerable software. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off downloading of print drivers over HTTP' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-downloading-of-print-drivers-over-http | HIGH | This policy setting controls whether the computer can download print driver packages over HTTP. To set up HTTP printing, printer drivers that are not available in the standard operating system installation might need to be downloaded over HTTP. | Users might download drivers that include malicious code. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off Help Experience Improvement Program (User)' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-help-experience-improvement-program | MEDIUM | This policy setting specifies whether users can participate in the Help Experience Improvement program. The Help Experience Improvement program collects information about how customers use Windows Help so that Microsoft can improve it. | Large enterprise managed environments may not want to have information collected by Microsoft from managed client computers. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-internet-connection-wizard-if-url-connection-is-referring-to-microsoft-com | MEDIUM | This policy setting specifies whether the Internet Connection Wizard can connect to Microsoft to download a list of Internet Service Providers (ISPs). | In an enterprise managed environment we want to lower the risk of a user unknowingly exposing sensitive data. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off Internet download for Web publishing and online ordering wizards' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-internet-download-for-web-publishing-and-online-ordering-wizards | HIGH | This policy setting controls whether Windows will download a list of providers for the Web publishing and online ordering wizards. | Although the risk is minimal, enabling this setting will reduce the possibility of a user unknowingly downloading malicious content through this feature. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off printing over HTTP' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-printing-over-http | MEDIUM | This policy setting allows you to disable the client computer's ability to print over HTTP, which allows the computer to print to printers on the intranet as well as the Internet. Note: This control affects printing over both HTTP and HTTPS. | Information that is transmitted over HTTP through this capability is not protected and can be intercepted by malicious users. For this reason, it is not often used in enterprise managed environments. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off Registration if URL connection is referring to Microsoft.com' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-registration-if-url-connection-is-referring-to-microsoft-com | MEDIUM | This policy setting specifies whether the Windows Registration Wizard connects to Microsoft.com for online registration. | Users in an enterprise managed environment should not be registering their own copies of Windows, providing their own PII in the process. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off Search Companion content file updates' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-search-companion-content-file-updates | MEDIUM | This policy setting specifies whether Search Companion should automatically download content updates during local and Internet searches. | There is a small risk that users will unknowingly reveal sensitive information because of the topics they are searching for. This risk is very low because even if this setting is enabled users still must submit search queries to the desired search engine in order to perform searches. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off the "Order Prints" picture task' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-the-order-prints-picture-task | MEDIUM | This policy setting specifies whether the "Order Prints Online" task is available from Picture Tasks in Windows folders. The Order Prints Online Wizard is used to download a list of providers and allow users to order prints online. | In an enterprise managed environment we want to lower the risk of a user unknowingly exposing sensitive data. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off the "Publish to Web" task for files and folders' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-the-publish-to-web-task-for-files-and-folders | MEDIUM | This policy setting specifies whether the tasks Publish this file to the Web, Publish this folder to the Web, and Publish the selected items to the Web are available from File and Folder Tasks in Windows folders. The Web Publishing wizard is used to download a list of providers and allow users to publish content to the Web. | Users may publish confidential or sensitive information to a public service outside of the control of the organization. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off the Windows Messenger Customer Experience Improvement Program' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-the-windows-messenger-customer-experience-improvement-program | MEDIUM | This policy setting specifies whether the Windows Customer Experience Improvement Program can collect anonymous information about how Windows is used. Microsoft uses information collected through the Windows Customer Experience Improvement Program to improve features that are most used and to detect flaws so that they can be corrected more quickly. Enabling this setting will reduce the amount of data Microsoft is able to gather for this purpose. | Large enterprise managed environments may not want to have information collected by Microsoft from managed client computers. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off Windows Customer Experience Improvement Program' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-windows-customer-experience-improvement-program | MEDIUM | This policy setting specifies whether Windows Messenger can collect anonymous information about how the Windows Messenger software and service is used. Microsoft uses information collected through the Windows Customer Experience Improvement Program to detect software flaws so that they can be corrected more quickly, enabling this setting will reduce the amount of data Microsoft is able to gather for this purpose. | Large enterprise managed environments may not want to have information collected by Microsoft from managed client computers. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off Windows Error Reporting' is set to 'Enabled'wt.windows.internet-communication-settings.turn-off-windows-error-reporting | MEDIUM | This policy setting controls whether or not errors are reported to Microsoft. Error Reporting is used to report information about a system or application that has failed or has stopped responding and is used to improve the quality of the product. | If a Windows Error occurs in a secure, enterprise managed environment, the error should be reported directly to IT staff for troubleshooting and remediation. There is no benefit to the corporation to report these errors directly to Microsoft, and there is some risk of unknowingly exposing sensitive data as part of the error. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Support device authentication using certificate' is set to 'Enabled: Automatic'wt.windows.kerberos.support-device-authentication-using-certificate | MEDIUM | This policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain. Support for device authentication using certificate will require connectivity to a DC in the device account domain which supports certificate authentication for computer accounts. | Having stronger device authentication with the use of certificates is strongly encouraged over standard username and password authentication. Having this set to Automatic will allow certificate based authentication to be used whenever possible. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable insecure guest logons' is set to 'Disabled'wt.windows.lanman-workstation.enable-insecure-guest-logons | HIGH | This policy setting determines if the SMB client will allow insecure guest logons to an SMB server. | Insecure guest logons are used by file servers to allow unauthenticated access to shared folders. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Disallow KMS Client Online AVS Validation' is set to 'Allow'wt.windows.licensing.disallow-kms-client-online-avs-validation | MEDIUM | The Key Management Service (KMS) is a Microsoft license activation method that entails setting up a local server to store the software licenses. The KMS server itself needs to connect to Microsoft to activate the KMS service, but subsequent on-network clients can activate Microsoft Windows OS and/or their Microsoft Office via the KMS server instead of connecting directly to Microsoft. This policy setting lets you opt-out of sending KMS client activation data to Microsoft automatically. | Even though the KMS licensing method does not require KMS clients to connect to Microsoft, they still send KMS client activation state data to Microsoft automatically. Preventing this information from being sent can help reduce privacy concerns in high security environments. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn on Mapper I/O (LLTDIO) driver' is set to 'Disabled'wt.windows.link-layer-topology-discovery.turn-on-mapper-i-o-lltdio-driver | MEDIUM | This policy setting changes the operational behavior of the Mapper I/O network protocol driver. LLTDIO allows a computer to discover the topology of a network it's connected to. It also allows a computer to initiate Quality-of-Service requests such as bandwidth estimation and network health analysis. | To help protect from potentially discovering and connecting to unauthorized devices, this setting should be disabled to prevent responding to network traffic for network topology discovery. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn on Responder (RSPNDR) driver' is set to 'Disabled'wt.windows.link-layer-topology-discovery.turn-on-responder | MEDIUM | This policy setting changes the operational behavior of the Responder network protocol driver. The Responder allows a computer to participate in Link Layer Topology Discovery requests so that it can be discovered and located on the network. It also allows a computer to participate in Quality-of-Service activities such as bandwidth estimation and network health analysis. | To help protect from potentially discovering and connecting to unauthorized devices, this setting should be disabled to prevent responding to network traffic for network topology discovery. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Accounts: Enable Guest account status' is set to 'Disabled'wt.windows.local-policies-security-options.accounts-guest-account-status | HIGH | This policy setting determines whether the Guest account is enabled or disabled. The Guest account allows unauthenticated network users to gain access to the system. Note: This setting will have no impact when applied to the Domain Controllers organizational unit via group policy because Domain Controllers have no local account database. It can be configured at the domain level via group policy, similar to account lockout and password policy settings. | The default Guest account allows unauthenticated network users to log on as Guest with no password. These unauthorized users could access any resources that are accessible to the Guest account over the network. This capability means that any network shares with permissions that allow access to the Guest account, the Guests group, or the Everyone group will be accessible over the network, which could lead to the exposure or corruption of data. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Accounts: Limit local account use of blank passwords to console logon only' is set to 'Enabled'wt.windows.local-policies-security-options.accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only | HIGH | Restricts local accounts whose password is blank to interactive logon at the physical keyboard only, blocking network, RDP, and service logons for those accounts. | Local accounts with no password are common on reimaged or hand-built machines and are a top target for SMB and RDP credential probes during lateral movement. Confining them to console use means an attacker on the wire cannot authenticate as one even if they discover the username. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Configure 'Accounts: Rename administrator account'wt.windows.local-policies-security-options.accounts-rename-administrator-account | HIGH | The built-in local administrator account is a well-known account name that attackers will target. It is recommended to choose another name for this account, and to avoid names that denote administrative or elevated access accounts. Be sure to also change the default description for the local administrator (through the Computer Management console). | The Administrator account exists on all computers that run the Windows 2000 or newer operating systems. If you rename this account, it is slightly more difficult for unauthorized persons to guess this privileged user name and password combination. The built-in Administrator account cannot be locked out, regardless of how many times an attacker might use a bad password. This capability makes the Administrator account a popular target for brute force attacks that attempt to guess passwords. The value of this countermeasure is lessened because this account has a well-known SID, and there are third-party tools that allow authentication by using the SID rather than the account name. Therefore, even if you rename the Administrator account, an attacker could launch a brute force attack by using the SID to log on. | None - manual attestation (documented review step) |
Configure 'Accounts: Rename guest account'wt.windows.local-policies-security-options.accounts-rename-guest-account | HIGH | The built-in local guest account is another well-known name to attackers. It is recommended to rename this account to something that does not indicate its purpose. Even if you disable this account, which is recommended, ensure that you rename it for added security. | The Guest account exists on all computers that run the Windows 2000 or newer operating systems. If you rename this account, it is slightly more difficult for unauthorized persons to guess this privileged user name and password combination. | None - manual attestation (documented review step) |
Ensure 'Devices: Prevent users from installing printer drivers when connecting to shared printers' is set to 'Enable'wt.windows.local-policies-security-options.devices-prevent-users-from-installing-printer-drivers-when-connecting-to-shared-printers | MEDIUM | For a computer to print to a shared printer, the driver for that shared printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of connecting to a shared printer. Note: This setting does not affect the ability to add a local printer. This setting does not affect Administrators. | It may be appropriate in some organizations to allow users to install printer drivers on their own workstations. However, in a high security environment, you should allow only Administrators, not users, to do this, because printer driver installation may unintentionally cause the computer to become less stable. A malicious user could install inappropriate printer drivers in a deliberate attempt to damage the computer, or a user might accidentally install malicious software that masquerades as a printer driver. It is feasible for an attacker to disguise a Trojan horse program as a printer driver. The program may appear to users as if they must use it to print, but such a program could unleash malicious code on your computer network. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Interactive logon: Do not require CTRL+ALT+DEL' is set to 'Disabled'wt.windows.local-policies-security-options.interactive-logon-do-not-require-ctrl-alt-del | HIGH | This policy setting determines whether users must press CTRL+ALT+DEL before they log on. | Microsoft developed this feature to make it easier for users with certain types of physical impairments to log on to computers that run Windows. If users are not required to press CTRL+ALT+DEL, they are susceptible to attacks that attempt to intercept their passwords. If CTRL+ALT+DEL is required before logon, user passwords are communicated by means of a trusted path. An attacker could install a Trojan horse program that looks like the standard Windows logon dialog box and capture the user's password. The attacker would then be able to log on to the compromised account with whatever level of privilege that user has. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Interactive logon: Do not display last signed-in' is set to 'Enabled'wt.windows.local-policies-security-options.interactive-logon-don-t-display-last-signed-in | HIGH | This policy setting determines whether the account name of the last user to log on to the client computers in your organization will be displayed in each computer's respective Windows logon screen. Enable this policy setting to prevent intruders from collecting account names visually from the screens of desktop or laptop computers in your organization. Warning: If the Self Service Password Reset (SSPR) feature is used in Microsoft Entra ID, an exception to this recommendation is needed as it's known to interfere with SSPR. Warning #2: If the Windows passwordless experience feature is used, an exception to this recommendation is needed as it prevents this feature from working. | An attacker with access to the console (for example, someone with physical access or someone who is able to connect to the server through Remote Desktop Services) could view the name of the last user who logged on to the server. The attacker could then try to guess the password, use a dictionary, or use a brute-force attack to try and log on. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Interactive logon: Machine inactivity limit' is set to '900 or fewer second(s), but not 0'wt.windows.local-policies-security-options.interactive-logon-machine-inactivity-limit | HIGH | Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session. Note: A value of 0 does not conform to the benchmark as it disables the machine inactivity limit. | If a user forgets to lock their computer when they walk away it's possible that a passerby will hijack it. | None - manual attestation (documented review step) |
Configure 'Interactive logon: Message text for users attempting to log on'wt.windows.local-policies-security-options.interactive-logon-message-text-for-users-attempting-to-log-on | HIGH | This policy setting specifies a text message that displays to users when they log on. Set the following group policy to a value that is consistent with the security and operational requirements of your organization. | Displaying a warning message before logon may help prevent an attack by warning the attacker about the consequences of their misconduct before it happens. It may also help to reinforce corporate policy by notifying employees of the appropriate policy during the logon process. This text is often used for legal reasons-for example, to warn users about the ramifications of misusing company information or to warn them that their actions may be audited. Note: Any warning that you display should first be approved by your organization's legal and human resources representatives. | None - manual attestation (documented review step) |
Configure 'Interactive logon: Message title for users attempting to log on'wt.windows.local-policies-security-options.interactive-logon-message-title-for-users-attempting-to-log-on | HIGH | This policy setting specifies the text displayed in the title bar of the window that users see when they log on to the system. Configure this setting in a manner that is consistent with the security and operational requirements of your organization. | Displaying a warning message before logon may help prevent an attack by warning the attacker about the consequences of their misconduct before it happens. It may also help to reinforce corporate policy by notifying employees of the appropriate policy during the logon process. | None - manual attestation (documented review step) |
Ensure 'Interactive logon: Smart card removal behavior' is set to 'Lock Workstation' or higherwt.windows.local-policies-security-options.interactive-logon-smart-card-removal-behavior | HIGH | This policy setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. Configuring this setting to Force Logoff or Disconnect if a Remote Desktop Services session also conforms to the benchmark. | Users sometimes forget to lock their workstations when they are away from them, allowing the possibility for malicious users to access their computers. If smart cards are used for authentication, the computer should automatically lock itself when the card is removed to ensure that only the user with the smart card is accessing resources using those credentials. | None - manual attestation (documented review step) |
Ensure 'Microsoft network client: Digitally sign communications (always)' is set to 'Enabled'wt.windows.local-policies-security-options.microsoft-network-client-digitally-sign-communications-always | HIGH | Requires the SMB client to sign every outbound SMB session, refusing to talk to any server that will not negotiate signing. | Unsigned SMB is the foundation of SMB-relay and NTLM-relay attacks, which let an on-path attacker reuse a captured authentication to read or write shares as the victim. Mandatory client-side signing breaks the relay primitive at the protocol level. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Microsoft network client: Digitally sign communications (if server agrees)' is set to 'Enabled'wt.windows.local-policies-security-options.microsoft-network-client-digitally-sign-communications-if-server-agrees | HIGH | This policy setting determines whether the SMB client will attempt to negotiate SMB packet signing. Note: Enabling this policy setting on SMB clients on your network makes them fully effective for packet signing with all clients and servers in your environment. | Session hijacking uses tools that allow attackers who have access to the same network as the client or server to interrupt, end, or steal a session in progress. Attackers can potentially intercept and modify unsigned SMB packets and then modify the traffic and forward it so that the server might perform undesirable actions. Alternatively, the attacker could pose as the server or client after legitimate authentication and gain unauthorized access to data. SMB is the resource sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate both users and the servers that host the data. If either side fails the authentication process, data transmission will not take place. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Microsoft network client: Send unencrypted password to third-party SMB servers' is set to 'Disabled'wt.windows.local-policies-security-options.microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers | HIGH | This policy setting determines whether the SMB redirector will send plaintext passwords during authentication to third-party SMB servers that do not support password encryption. It is recommended that you disable this policy setting unless there is a strong business case to enable it. If this policy setting is enabled, unencrypted passwords will be allowed across the network. | If you enable this policy setting, the server can transmit passwords in plaintext across the network to other computers that offer SMB services, which is a significant security risk. These other computers may not use any of the SMB security mechanisms that are included with Windows Server 2003. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Microsoft network server: Digitally sign communications (always)' is set to 'Enabled'wt.windows.local-policies-security-options.microsoft-network-server-digitally-sign-communications-always | HIGH | Requires the SMB server component on this device to sign every inbound SMB session and refuse any client that will not negotiate signing. | Workstations that share files or printers can themselves be relay targets, where an attacker captures a Net-NTLM challenge from one machine and replays it against this device's SMB server. Mandatory server-side signing kills the relay attempt before any file is read or written. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Microsoft network server: Digitally sign communications (if client agrees)' is set to 'Enabled'wt.windows.local-policies-security-options.microsoft-network-server-digitally-sign-communications-if-client-agrees | HIGH | Tells this device's SMB server to negotiate signing whenever a client requests it, even when the always-sign requirement is not in force. | Some legacy clients negotiate signing only when the server signals support, so without this setting many sessions silently stay unsigned and remain vulnerable to SMB relay and tampering. Combined with the always-sign policy, this maximises the share of real-world traffic that ends up signed. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts' is set to 'Enabled'wt.windows.local-policies-security-options.network-access-do-not-allow-anonymous-enumeration-of-sam-accounts | HIGH | Blocks anonymous (null-session) callers from enumerating accounts in the local Security Accounts Manager (SAM) database. | Account name enumeration converts an unauthenticated network probe into a working target list for password spraying, AS-REP roasting, and social engineering. Disallowing it forces an attacker to come up with valid credentials before they learn which accounts even exist on the device. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' is set to 'Enabled'wt.windows.local-policies-security-options.network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares | HIGH | Blocks anonymous (null-session) callers from listing both local SAM account names and the names of file shares on this device. | Anonymous enumeration is the first step in most internal reconnaissance, giving an attacker a clean list of accounts to spray and shares to probe without ever authenticating. Cutting it off forces them to gain credentials before they can map the device's identities or resources. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Network access: Restrict anonymous access to Named Pipes and Shares' is set to 'Enabled'wt.windows.local-policies-security-options.network-access-restrict-anonymous-access-to-named-pipes-and-shares | HIGH | When enabled, this policy setting restricts anonymous access to only those shares and pipes that are named in the Network access: Named pipes that can be accessed anonymously and Network access: Shares that can be accessed anonymously settings. This policy setting controls null session access to shares on your computers by adding RestrictNullSessAccess with the value 1 in the HKLM\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters registry key. This registry value toggles null session shares on or off to control whether the server service restricts unauthenticated clients' access to named resources. | Null sessions are a weakness that can be exploited through shares (including the default shares) on computers in your environment. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Network access: Restrict clients allowed to make remote calls to SAM' is set to 'Administrators: Remote Access: Allow'wt.windows.local-policies-security-options.network-access-restrict-clients-allowed-to-make-remote-calls-to-sam | HIGH | This policy setting allows you to restrict remote RPC connections to SAM. Note: A Windows 10 R1607, Server 2016 or newer OS is required to access and set this value in Group Policy. Note #2: This setting was originally only supported on Windows 10 R1607 or newer, then support for it was added to Windows 7 or newer via the March 2017 security patches. Note #3: If your organization is using Microsoft Defender for Identity (formerly Azure Advanced Threat Protection (Azure ATP)), the (organization-named) Defender for Identity Directory Service Account (DSA), will also need to be granted the same Remote Access: Allow permission. For more information on adding the service account please see Configure SAM-R to enable lateral movement path detection in Microsoft Defender for Identity | Microsoft Docs. | To ensure that an unauthorized user cannot anonymously list local account names or groups and use the information to attempt to guess passwords or perform social engineering attacks. (Social engineering attacks try to deceive users in some way to obtain passwords or some form of security information.) | None - manual attestation (documented review step) |
Ensure 'Network security: Allow Local System to use computer identity for NTLM' is set to 'Allow'wt.windows.local-policies-security-options.network-security-allow-local-system-to-use-computer-identity-for-ntlm | HIGH | This policy setting determines whether Local System services that use Negotiate when reverting to NTLM authentication can use the computer identity. This policy is supported on at least Windows 7 or Windows Server 2008 R2. | When connecting to computers running versions of Windows earlier than Windows Vista or Windows Server 2008 (non-R2), services running as Local System and using SPNEGO (Negotiate) that revert to NTLM use the computer identity. In Windows 7, if you are connecting to a computer running Windows Server 2008 or Windows Vista, then a system service uses either the computer identity or a NULL session. When connecting with a NULL session, a system-generated session key is created, which provides no protection but allows applications to sign and encrypt data without errors. When connecting with the computer identity, both signing and encryption is supported in order to provide data protection. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Network Security: Allow PKU2U authentication requests' is set to 'Block'wt.windows.local-policies-security-options.network-security-allow-pku2u-authentication-requests-to-this-computer | HIGH | This setting determines if online identities are able to authenticate to this computer. The Public Key Cryptography Based User-to-User (PKU2U) protocol introduced in Windows 7 and Windows Server 2008 R2 is implemented as a security support provider (SSP). The SSP enables peer-to-peer authentication, particularly through the Windows 7 media and file sharing feature called HomeGroup, which permits sharing between computers that are not members of a domain. With PKU2U, a new extension was introduced to the Negotiate authentication package, Spnego.dll. In previous versions of Windows, Negotiate decided whether to use Kerberos or NTLM for authentication. The extension SSP for Negotiate, Negoexts.dll, which is treated as an authentication protocol by Windows, supports Microsoft SSPs including PKU2U. When computers are configured to accept authentication requests by using online IDs, Negoexts.dll calls the PKU2U SSP on the computer that is used to log on. The PKU2U SSP obtains a local certificate and exchanges the policy between the peer computers. When validated on the peer computer, the certificate within the metadata is sent to the logon peer for validation and associates the user's certificate to a security token and the logon process completes. | The PKU2U protocol is a peer-to-peer authentication protocol - authentication should be managed centrally in most managed networks. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Network security: Do not store LAN Manager hash value on next password change' is set to 'Enabled'wt.windows.local-policies-security-options.network-security-do-not-store-lan-manager-hash-value-on-next-password-change | HIGH | This policy setting determines whether the LAN Manager (LM) hash value for the new password is stored when the password is changed. The LM hash is relatively weak and prone to attack compared to the cryptographically stronger Microsoft Windows NT hash. Since LM hashes are stored on the local computer in the security database, passwords can then be easily compromised if the database is attacked. Note: Older operating systems and some third-party applications may fail when this policy setting is enabled. Also, note that the password will need to be changed on all accounts after you enable this setting to gain the proper benefit. | The SAM file can be targeted by attackers who seek access to username and password hashes. Such attacks use special tools to crack passwords, which can then be used to impersonate users and gain access to resources on your network. These types of attacks will not be prevented if you enable this policy setting, but it will be much more difficult for these types of attacks to succeed. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Network security: LAN Manager authentication level' is set to 'Send LM and NTLMv2 responses only. Refuse LM and NTLM'wt.windows.local-policies-security-options.network-security-lan-manager-authentication-level | HIGH | LAN Manager (LM) was a family of early Microsoft client/server software (predating Windows NT) that allowed users to link personal computers together on a single network. LM network capabilities included transparent file and print sharing, user security features, and network administration tools. In Active Directory domains, the Kerberos protocol is the default authentication protocol. However, if the Kerberos protocol is not negotiated for some reason, Active Directory will use LM, NTLM, or NTLMv2. LAN Manager authentication includes the LM, NTLM, and NTLM version 2 (NTLMv2) variants, and is the protocol that is used to authenticate all Windows clients when they perform the following operations: • Join a domain • Authenticate between Active Directory forests • Authenticate to down-level domains • Authenticate to computers that do not run Windows 2000, Windows Server 2003, or Windows XP • Authenticate to computers that are not in the domain The Network security: LAN Manager authentication level setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers. Refuse LM and NTLM. | Windows 2000 and Windows XP clients were configured by default to send LM and NTLM authentication responses (Windows 95-based and Windows 98-based clients only send LM). The default settings in OSes predating Windows Vista / Windows Server 2008 (non-R2) allowed all clients to authenticate with servers and use their resources. However, this meant that LM responses - the weakest form of authentication response - were sent over the network, and it was potentially possible for attackers to sniff that traffic to more easily reproduce the user's password. The Windows 95, Windows 98, and Windows NT operating systems cannot use the Kerberos version 5 protocol for authentication. For this reason, in a Windows Server 2003 domain, these computers authenticate by default with both the LM and NTLM protocols for network authentication. You can enforce a more secure authentication protocol for Windows 95, Windows 98, and Windows NT by using NTLMv2. For the logon process, NTLMv2 uses a secure channel to protect the authentication process. Even if you use NTLMv2 for older clients and servers, Windows-based clients and servers that are members of the domain will use the Kerberos authentication protocol to authenticate with Windows Server 2003 or newer Domain Controllers. For these reasons, it is strongly preferred to restrict the use of LM & NTLM (non-v2) as much as possible. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Network Security Minimum Session Security For NTLMSSP Based Clients' is set to 'Require NTLM and 128-bit encryption'wt.windows.local-policies-security-options.network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients | HIGH | This policy setting determines which behaviors are allowed by clients for applications using the NTLM Security Support Provider (SSP). The SSP Interface (SSPI) is used by applications that need authentication services. The setting does not modify how the authentication sequence works but instead require certain behaviors in applications that use the SSPI. Note: These values are dependent on the Network security: LAN Manager Authentication Level security setting value. | You can enable both options for this policy setting to help protect network traffic that uses the NTLM Security Support Provider (NTLM SSP) from being exposed or tampered with by an attacker who has gained access to the same network. In other words, these options help protect against man-in-the-middle attacks. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Network Security Minimum Session Security For NTLMSSP Based Servers' is set to 'Require NTLM and 128-bit encryption'wt.windows.local-policies-security-options.network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers | HIGH | This policy setting determines which behaviors are allowed by servers for applications using the NTLM Security Support Provider (SSP). The SSP Interface (SSPI) is used by applications that need authentication services. The setting does not modify how the authentication sequence works but instead require certain behaviors in applications that use the SSPI. Note: These values are dependent on the Network security: LAN Manager Authentication Level security setting value. | You can enable all of the options for this policy setting to help protect network traffic that uses the NTLM Security Support Provider (NTLM SSP) from being exposed or tampered with by an attacker who has gained access to the same network. That is, these options help protect against man-in-the-middle attacks. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Network security: Restrict NTLM: Audit Incoming NTLM Traffic' is set to 'Enable auditing for all accounts'wt.windows.local-policies-security-options.network-security-restrict-ntlm-audit-incoming-ntlm-traffic | HIGH | This policy setting allows the auditing of incoming NTLM traffic. Events for this setting are recorded in the operational event log (e.g. Applications and Services Log\Microsoft\Windows\NTLM). | Auditing and monitoring NTLM traffic can assist in identifying systems using this outdated authentication protocol, so they can be remediated to using a more secure protocol, such as Kerberos. The log information gathered can also assist in forensic investigations after a malicious attack. NTLM and NTLMv2 authentication is vulnerable to various attacks, including SMB relay, man-in-the-middle, and brute force attacks. Reducing and eliminating NTLM authentication in an environment reduces the risk of an attacker gaining access to systems on the network. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'User Account Control: Behavior of the elevation prompt for administrators' is set to 'Prompt for consent on the secure desktop' or higherwt.windows.local-policies-security-options.user-account-control-behavior-of-the-elevation-prompt-for-administrators | HIGH | This policy setting controls the behavior of the elevation prompt for administrators. Configuring this setting to Prompt for credentials on the secure desktop also conforms to the benchmark. | One of the risks that the UAC feature introduced with Windows Vista is trying to mitigate is that of malicious software running under elevated credentials without the user or administrator being aware of its activity. This setting raises awareness to the administrator of elevated privilege operations and permits the administrator to prevent a malicious program from elevating its privilege when the program attempts to do so. | None - manual attestation (documented review step) |
Ensure 'User Account Control: Behavior of the elevation prompt for standard users' is set to 'Automatically deny elevation requests'wt.windows.local-policies-security-options.user-account-control-behavior-of-the-elevation-prompt-for-standard-users | HIGH | This policy setting controls the behavior of the elevation prompt for standard users. | One of the risks that the User Account Control feature introduced with Windows Vista is trying to mitigate is that of malicious programs running under elevated credentials without the user or administrator being aware of their activity. This setting raises awareness to the user that a program requires the use of elevated privilege operations and requires that the user be able to supply administrative credentials in order for the program to run. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'User Account Control: Detect application installations and prompt for elevation' is set to 'Enabled'wt.windows.local-policies-security-options.user-account-control-detect-application-installations-and-prompt-for-elevation | HIGH | This policy setting controls the behavior of application installation detection for the computer. | Some malicious software will attempt to install itself after being given permission to run. For example, malicious software with a trusted application shell. The user may have given permission for the program to run because the program is trusted, but if they are then prompted for installation of an unknown component this provides another way of trapping the software before it can do damage | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'User Account Control: Only elevate UIAccess applications that are installed in secure locations' is set to 'Enabled'wt.windows.local-policies-security-options.user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations | HIGH | This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: • …\Program Files, including subfolders • …\Windows\System32\ • …\Program Files (x86), including subfolders (for 64-bit versions of Windows) Note: Windows enforces a public key infrastructure (PKI) signature check on any interactive application that requests to run with a UIAccess integrity level regardless of the state of this security setting. | UIAccess Integrity allows an application to bypass User Interface Privilege Isolation (UIPI) restrictions when an application is elevated in privilege from a standard user to an administrator. This is required to support accessibility features such as screen readers that are transmitting user interfaces to alternative forms. A process that is started with UIAccess rights has the following abilities: • To set the foreground window. • To drive any application window using SendInput function. • To use read input for all integrity levels using low-level hooks, raw input, GetKeyState, GetAsyncKeyState, and GetKeyboardInput. • To set journal hooks. • To uses AttachThreadInput to attach a thread to a higher integrity input queue. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'User Account Control: Run all administrators in Admin Approval Mode' is set to 'Enabled'wt.windows.local-policies-security-options.user-account-control-run-all-administrators-in-admin-approval-mode | HIGH | This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. | This is the setting that turns on or off UAC. If this setting is disabled, UAC will not be used and any security benefits and risk mitigations that are dependent on UAC will not be present on the system. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled'wt.windows.local-policies-security-options.user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation | HIGH | This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop. | Standard elevation prompt dialog boxes can be spoofed, which may cause users to disclose their passwords to malicious software. The secure desktop presents a very distinct appearance when prompting for elevation, where the user desktop dims, and the elevation prompt UI is more prominent. This increases the likelihood that users who become accustomed to the secure desktop will recognize a spoofed elevation prompt dialog box and not fall for the trick. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'User Account Control: Use Admin Approval Mode' is set to 'Enabled'wt.windows.local-policies-security-options.user-account-control-use-admin-approval-mode | HIGH | This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account. | One of the risks that the User Account Control feature introduced with Windows Vista is trying to mitigate is that of malicious software running under elevated credentials without the user or administrator being aware of its activity. An attack vector for these programs was to discover the password of the account named "Administrator" because that user account was created for all installations of Windows. To address this risk, in Windows Vista or newer, the built-in Administrator account is now disabled by default. In a default installation of a new computer, accounts with administrative control over the computer are initially set up in one of two ways: • If the computer is not joined to a domain, the first user account you create has the equivalent permissions as a local administrator. • If the computer is joined to a domain, no local administrator accounts are created. The Enterprise or Domain Administrator must log on to the computer and create one if a local administrator account is warranted. Once Windows is installed, the built-in Administrator account may be manually enabled, but we strongly recommend that this account remain disabled. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'User Account Control: Virtualize file and registry write failures to per-user locations' is set to 'Enabled'wt.windows.local-policies-security-options.user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations | HIGH | This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to: • %ProgramFiles% • %windir% • %windir%\System32 • HKLM\SOFTWARE | This setting reduces vulnerabilities by ensuring that legacy applications only write data to permitted locations. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure Lsa Protected Process is set to 'Enabled with UEFI Lock...'wt.windows.local-security-authority.configure-lsa-protected-process | HIGH | This policy setting controls whether the Local Security Authority Subservice Service (LSASS) runs in protected mode and also has the option to lock in protected mode with Unified Extensible Firmware Interface (UEFI). The Local Security Authority (LSA), which includes the LSASS process, validates users for local and remote sign-ins and enforces local security policies. LSA will run as protected process and this configuration is UEFI locked. | Provides added security for the credentials that LSA stores and manages. Enabling this setting with UEFI Lock prevents the setting from being changed remotely. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Disallow copying of user input methods to the system account for sign-in' is set to 'Enabled'wt.windows.locale-services.disallow-copying-of-user-input-methods-to-the-system-account-for-sign-in | MEDIUM | This policy prevents automatic copying of user input methods to the system account for use on the sign-in screen. The user is restricted to the set of input methods that are enabled in the system account. | This is a way to increase the security of the system account. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Block user from showing account details on sign-in' is set to 'Enabled'wt.windows.logon.block-user-from-showing-account-details-on-sign-in | HIGH | This policy prevents the user from showing account details (email address or user name) on the sign-in screen. | An attacker with access to the console (for example, someone with physical access or someone who is able to connect to the workstation through Remote Desktop Services) could view the name of the last user who logged on to the server. The attacker could then try to guess the password, use a dictionary, or use a brute-force attack to try and log on. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Do not display network selection UI' is set to 'Enabled'wt.windows.logon.do-not-display-network-selection-ui | HIGH | This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen. | An unauthorized user could disconnect the PC from the network or can connect the PC to other available networks without signing into Windows. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Do not enumerate connected users on domain-joined computers' is set to 'Enabled'wt.windows.logon.do-not-enumerate-connected-users-on-domain-joined-computers | HIGH | This policy setting prevents connected users from being enumerated on domain-joined computers. | A malicious user could use this feature to gather account names of other users, that information could then be used in conjunction with other types of attacks such as guessing passwords or social engineering. The value of this countermeasure is small because a user with domain credentials could gather the same account information using other methods. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enumerate local users on domain-joined computers' is set to 'Disabled'wt.windows.logon.enumerate-local-users-on-domain-joined-computers | HIGH | This policy setting allows local users to be enumerated on domain-joined computers. | A malicious user could use this feature to gather account names of other users, that information could then be used in conjunction with other types of attacks such as guessing passwords or social engineering. The value of this countermeasure is small because a user with domain credentials could gather the same account information using other methods. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off app notifications on the lock screen' is set to 'Enabled'wt.windows.logon.turn-off-app-notifications-on-the-lock-screen | HIGH | This policy setting allows you to prevent app notifications from appearing on the lock screen. Warning: If the Self Service Password Reset (SSPR) feature is used in Microsoft Entra ID, an exception to this recommendation is needed as it's known to interfere with SSPR. | App notifications might display sensitive business or personal data. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off picture password sign-in' is set to 'Enabled'wt.windows.logon.turn-off-picture-password-sign-in | HIGH | This policy setting allows you to control whether a domain user can sign in using a picture password. Note: If the picture password feature is permitted, the user's domain password is cached in the system vault when using it. | Picture passwords bypass the requirement for a typed complex password. In a shared work environment, a simple shoulder surf where someone observed the on-screen gestures would allow that person to gain access to the system without the need to know the complex password. Vertical monitor screens with an image are much more visible at a distance than horizontal key strokes, increasing the likelihood of a successful observation of the mouse gestures. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn on convenience PIN sign-in' is set to 'Disabled'wt.windows.logon.turn-on-convenience-pin-sign-in | HIGH | This policy setting allows you to control whether a user can sign in using a convenience PIN. Note: The user's password will be cached in the system vault when using this feature. | A PIN is created from a much smaller selection of characters than a password, so in most cases a PIN will be much less robust than a password. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure local setting override for reporting to Microsoft MAPS' is set to 'Disabled'wt.windows.maps.configure-local-setting-override-for-reporting-to-microsoft-maps | HIGH | This policy setting configures a local override for the configuration to join Microsoft Active Protection Service (MAPS), which Microsoft renamed to Windows Defender Antivirus Cloud Protection Service and then Microsoft Defender Antivirus Cloud Protection Service. | The decision on whether or not to participate in Microsoft MAPS / Microsoft Defender Antivirus Cloud Protection Service for malicious software reporting should be made centrally in an enterprise managed environment, so that all computers within it behave consistently in that regard. Configuring this setting to Disabled ensures that the decision remains centrally managed. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Join Microsoft MAPS' is set to 'Disabled'wt.windows.maps.join-microsoft-maps | MEDIUM | This policy setting allows you to join Microsoft Active Protection Service (MAPS), which Microsoft renamed to Windows Defender Antivirus Cloud Protection Service and then Microsoft Defender Antivirus Cloud Protection Service. Microsoft MAPS / Microsoft Defender Antivirus Cloud Protection Service is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. Possible options are: • (0x0) Disabled (default) • (0x1) Basic membership • (0x2) Advanced membership Basic membership will send basic information to Microsoft about software that has been detected including where the software came from the actions that you apply or that are applied automatically and whether the actions were successful. Advanced membership in addition to basic information will send more information to Microsoft about malicious software spyware and potentially unwanted software including the location of the software file names how the software operates and how it has impacted your computer. Note: In Windows 10 and above, Basic membership is no longer available, so setting the value to 1 Basic, or 2 Advanced, enrolls the device into Advanced membership. For more information, please visit: Turn on cloud protection in Microsoft Defender Antivirus - Microsoft Defender for Endpoint | Microsoft Learn. | The information that would be sent can include things like location of detected items on your computer if harmful software was removed. The information would be automatically collected and sent. In some instances personal information might unintentionally be sent to Microsoft. However, Microsoft states that it will not use this information to identify you or contact you. For privacy reasons in high security environments, it is best to prevent these data submissions altogether. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Message Sync' is set to 'message sync is not allowed and cannot be changed by the user.'wt.windows.messaging.allow-message-sync | MEDIUM | This policy setting allows backup and restore of cellular text messages to Microsoft's cloud services. . | In a high security environment, data should never be sent to any third-party since this data could contain sensitive information. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Block all consumer Microsoft account user authentication' is set to 'Enabled'wt.windows.microsoft-accounts.block-all-consumer-microsoft-account-user-authentication | HIGH | This setting determines whether applications and services on the device can utilize new consumer Microsoft account authentication via the Windows OnlineID and WebAccountManager APIs. | Organizations that want to effectively implement identity management policies and maintain firm control of what accounts are used on their computers will probably want to block Microsoft accounts. Organizations may also need to block Microsoft accounts in order to meet the requirements of compliance standards that apply to their information systems. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow apps from the Microsoft app store to auto update' is set to 'Allowed'wt.windows.microsoft-app-store.allow-apps-from-the-microsoft-app-store-to-auto-update | HIGH | This setting enables or disables the automatic download and installation of Microsoft Store app updates. | Keeping your system properly patched can help protect against 0 day vulnerabilities. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Game DVR' is set to 'Block' (Automated)wt.windows.microsoft-app-store.allow-game-dvr | HIGH | This setting enables or disables the Windows Game Recording and Broadcasting features. | If this setting is allowed, users could record and broadcast session info to external sites, which is both a risk of accidentally exposing sensitive company data (on-screen) outside the company as well as a privacy concern. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Shared User App Data' is set to 'Block'wt.windows.microsoft-app-store.allow-shared-user-app-data | MEDIUM | Manages a Windows app's ability to share data between users who have installed the app. Data is shared through the SharedLocal folder. This folder is available through the Windows.Storage API. | Users of a system could accidentally share sensitive data with other users on the same system. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Block Non Admin User Install' is set to 'Allow'wt.windows.microsoft-app-store.block-non-admin-user-install | HIGH | This setting manages non-Administrator users' ability to install Windows app packages. Warning: If the Self Service Password Reset (SSPR) feature is used in Microsoft Entra ID, an exception to this recommendation is needed as it's known to interfere with SSPR. | In a corporate managed environment, application installations should be managed centrally by IT staff, not by end users. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Disable Store Originated Apps' is set to 'Enabled'wt.windows.microsoft-app-store.disable-store-originated-apps | MEDIUM | This setting configures the launch of all apps from the Microsoft Store that came pre- installed or were downloaded. Note: This policy setting only applies to Windows 10 Enterprise and Windows 10 Education editions. | The Store service is a retail outlet built into Windows, primarily for consumer use. In an enterprise managed environment the IT department should be managing the installation of all applications to reduce the risk of the installation of vulnerable software. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSI Allow user control over installs' is set to 'Disabled'wt.windows.microsoft-app-store.msi-allow-user-control-over-installs | HIGH | This setting controls whether users are permitted to change installation options that typically are available only to system administrators. The security features of Windows Installer normally prevent users from changing installation options that are typically reserved for system administrators, such as specifying the directory to which files are installed. If Windows Installer detects that an installation package has permitted the user to change a protected option, it stops the installation and displays a message. These security features operate only when the installation program is running in a privileged security context in which it has access to directories denied to the user. | In an enterprise managed environment, only IT staff with administrative rights should be installing or changing software on a system. Allowing users the ability to have any control over installs can risk unapproved software from being installed or removed from a system, which could cause the system to become vulnerable to compromise. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSI Always install with elevated privileges' is set to 'Disabled'wt.windows.microsoft-app-store.msi-always-install-with-elevated-privileges | HIGH | This setting controls whether or not Windows Installer should use system permissions when it installs any program on the system. Note: This setting appears both in the Computer Configuration and User Configuration folders. To make this setting effective, you must enable the setting in both folders. Caution: If enabled, skilled users can take advantage of the permissions this setting grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this setting is not guaranteed to be secure. | Users with limited privileges can exploit this feature by creating a Windows Installer installation package that creates a new local account that belongs to the local built-in Administrators group, adds their current account to the local built-in Administrators group, installs malicious software, or performs other unauthorized activities. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSI Always install with elevated privileges (User)' is set to 'Disabled'wt.windows.microsoft-app-store.msi-always-install-with-elevated-privileges-user | HIGH | This setting controls whether or not Windows Installer should use system permissions when it installs any program on the system. Note: This setting appears both in the Computer Configuration and User Configuration folders. To make this setting effective, you must enable the setting in both folders. Caution: If enabled, skilled users can take advantage of the permissions this setting grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this setting is not guaranteed to be secure. | Users with limited privileges can exploit this feature by creating a Windows Installer installation package that creates a new local account that belongs to the local built-in Administrators group, adds their current account to the local built-in Administrators group, installs malicious software, or performs other unauthorized activities. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider' is set to 'Disabled'wt.windows.microsoft-support-diagnostic-tool.microsoft-support-diagnostic-tool-turn-on-msdt-interactive-communication-with-support-provider | MEDIUM | This policy setting configures Microsoft Support Diagnostic Tool (MSDT) interactive communication with the support provider. MSDT gathers diagnostic data for analysis by support professionals. | Due to privacy concerns, data should never be sent to any third-party since this data could contain sensitive information. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Apply UAC restrictions to local accounts on network logons' is set to 'Enabled'wt.windows.ms-security-guide.apply-uac-restrictions-to-local-accounts-on-network-logons | HIGH | This setting controls whether local accounts can be used for remote administration via network logon (e.g., NET USE, connecting to C$, etc.). Local accounts are at high risk for credential theft when the same account and password is configured on multiple systems. Enabling this policy significantly reduces that risk. Enabled: Applies UAC token-filtering to local accounts on network logons. Membership in powerful group such as Administrators is disabled and powerful privileges are removed from the resulting access token. This configures the LocalAccountTokenFilterPolicy registry value to 0. This is the default behavior for Windows. Disabled: Allows local accounts to have full administrative rights when authenticating via network logon, by configuring the LocalAccountTokenFilterPolicy registry value to 1. For more information about local accounts and credential theft, review the "Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques" documents. For more information about LocalAccountTokenFilterPolicy, see Microsoft Knowledge Base article 951016: Description of User Account Control and remote restrictions in Windows Vista. | Local accounts are at high risk for credential theft when the same account and password is configured on multiple systems. Ensuring this policy is Enabled significantly reduces that risk. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure SMB v1 client driver' is set to 'Enabled: Disable driver (recommended)'wt.windows.ms-security-guide.configure-smb-v1-client-driver | HIGH | This setting configures the start type for the Server Message Block version 1 (SMBv1) client driver service (MRxSmb10), which is recommended to be disabled. Note: Do not, under any circumstances, configure this overall setting as Disabled, as doing so will delete the underlying registry entry altogether, which will cause serious problems. | Since September 2016, Microsoft has strongly encouraged that SMBv1 be disabled and no longer used on modern networks, as it is a 30 year old design that is much more vulnerable to attacks then much newer designs such as SMBv2 and SMBv3. More information on this can be found at the following links: Stop using SMB1 | Storage at Microsoft Disable SMB v1 in Managed Environments with Group Policy - "Stay Safe" Cyber Security Blog Disabling SMBv1 through Group Policy - Microsoft Security Guidance blog | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure SMB v1 server' is set to 'Disabled'wt.windows.ms-security-guide.configure-smb-v1-server | HIGH | This setting configures the server-side processing of the Server Message Block version 1 (SMBv1) protocol. | Since September 2016, Microsoft has strongly encouraged that SMBv1 be disabled and no longer used on modern networks, as it is a 30 year old design that is much more vulnerable to attacks then much newer designs such as SMBv2 and SMBv3. More information on this can be found at the following links: Stop using SMB1 | Storage at Microsoft Disable SMB v1 in Managed Environments with Group Policy - "Stay Safe" Cyber Security Blog Disabling SMBv1 through Group Policy - Microsoft Security Guidance blog | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Structured Exception Handling Overwrite Protection (SEHOP)' is set to 'Enabled'wt.windows.ms-security-guide.enable-structured-exception-handling-overwrite-protection-sehop-more-information-is-available-at-mskb-956607-how-to-enable-structured-exception-handling-overwrite-protection-sehop-in-windows-operating-systems | HIGH | Windows includes support for Structured Exception Handling Overwrite Protection (SEHOP). We recommend enabling this feature to improve the security profile of the computer. | This feature is designed to block exploits that use the Structured Exception Handler (SEH) overwrite technique. This protection mechanism is provided at run-time. Therefore, it helps protect applications regardless of whether they have been compiled with the latest improvements, such as the /SAFESEH option. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'WDigest Authentication' is set to 'Disabled'wt.windows.ms-security-guide.wdigest-authentication-disabling-may-require-kb2871997 | HIGH | Disables WDigest authentication so the legacy SSP no longer keeps the user's plaintext password resident in LSASS memory. | With WDigest enabled, any tool that can read LSASS (Mimikatz, comsvcs minidump, EDR-bypass loaders) extracts cleartext passwords directly rather than hashes. Turning WDigest off is the single most cost-effective change against credential dumping on a Windows endpoint. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)' is set to 'Disabled'wt.windows.mss-legacy.autoadminlogon-enable-automatic-logon-not-recommended | HIGH | This setting is separate from the Welcome screen feature in Windows XP and Windows Vista; if that feature is disabled, this setting is not disabled. If you configure a computer for automatic logon, anyone who can physically gain access to the computer can also gain access to everything that is on the computer, including any network or networks to which the computer is connected. Also, if you enable automatic logon, the password is stored in the registry in plaintext, and the specific registry key that stores this value is remotely readable by the Authenticated Users group. For additional information, see Microsoft Knowledge Base article 324737: How to turn on automatic logon in Windows. | If you configure a computer for automatic logon, anyone who can physically gain access to the computer can also gain access to everything that is on the computer, including any network or networks that the computer is connected to. Also, if you enable automatic logon, the password is stored in the registry in plaintext. The specific registry key that stores this setting is remotely readable by the Authenticated Users group. As a result, this entry is appropriate only if the computer is physically secured and if you ensure that untrusted users cannot remotely see the registry. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' is set to 'Enabled: Highest protection, source routing is completely disabled'wt.windows.mss-legacy.disableipsourcerouting-ip-source-routing-protection-level-protects-against-packet-spoofing | HIGH | IP source routing is a mechanism that allows the sender to determine the IP route that a datagram should take through the network. It is recommended to configure this setting to Not Defined for enterprise environments and to Highest Protection for high security environments to completely disable source routing. | An attacker could use source routed packets to obscure their identity and location. Source routing allows a computer that sends a packet to specify the route that the packet takes. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)' is set to 'Enabled: Highest protection, source routing is completely disabled'wt.windows.mss-legacy.disableipsourcerouting-ipv6-ip-source-routing-protection-level-protects-against-packet-spoofing | HIGH | IP source routing is a mechanism that allows the sender to determine the IP route that a datagram should follow through the network. | An attacker could use source routed packets to obscure their identity and location. Source routing allows a computer that sends a packet to specify the route that the packet takes. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSS: (DisableSavePassword) Prevent the dial-up password from being saved (recommended)' is set to 'Enabled'wt.windows.mss-legacy.disablesavepassword-prevent-the-dial-up-password-from-being-saved-recommended | MEDIUM | When you dial a phonebook or VPN entry in Dial-Up Networking, you can use the "Save Password" option so that your Dial-Up Networking password is cached and you will not need to enter it on successive dial attempts. For security, administrators may want to prevent users from caching passwords. | An attacker who steals a mobile user's computer could automatically connect to the organization's network if the Save This Password check box is selected for the dial-up or VPN networking entry used to connect to your organization's network. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled'wt.windows.mss-legacy.enableicmpredirect-allow-icmp-redirects-to-override-ospf-generated-routes | HIGH | Internet Control Message Protocol (ICMP) redirects cause the IPv4 stack to plumb host routes. These routes override the Open Shortest Path First (OSPF) generated routes. | This behavior is expected. The problem is that the 10 minute time-out period for the ICMP redirect-plumbed routes temporarily creates a network situation in which traffic will no longer be routed properly for the affected host. Ignoring such ICMP redirects will limit the system's exposure to attacks that will impact its ability to participate on the network. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes (recommended)'wt.windows.mss-legacy.keepalivetime-how-often-keep-alive-packets-are-sent-in-milliseconds | MEDIUM | This value controls how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet. If the remote computer is still reachable, it acknowledges the keep-alive packet. | An attacker who is able to connect to network applications could establish numerous connections to cause a DoS condition. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled'wt.windows.mss-legacy.nonamereleaseondemand-allow-the-computer-to-ignore-netbios-name-release-requests-except-from-wins-servers | HIGH | NetBIOS over TCP/IP is a network protocol that among other things provides a way to easily resolve NetBIOS names that are registered on Windows-based systems to the IP addresses that are configured on those systems. This setting determines whether the computer releases its NetBIOS name when it receives a name-release request. | The NetBT protocol is designed not to use authentication, and is therefore vulnerable to spoofing. Spoofing makes a transmission appear to come from a user other than the user who performed the action. A malicious user could exploit the unauthenticated nature of the protocol to send a name-conflict datagram to a target computer, which would cause the computer to relinquish its name and not respond to queries. An attacker could send a request over the network and query a computer to release its NetBIOS name. As with any change that could affect applications, it is recommended that you test this change in a non-production environment before you change the production environment. The result of such an attack could be to cause intermittent connectivity issues on the target computer, or even to prevent the use of Network Neighborhood, domain logons, the NET SEND command, or additional NetBIOS name resolution. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)' is set to 'Disabled'wt.windows.mss-legacy.performrouterdiscovery-allow-irdp-to-detect-and-configure-default-gateway-addresses-could-lead-to-dos | MEDIUM | This setting is used to enable or disable the Internet Router Discovery Protocol (IRDP), which allows the system to detect and configure default gateway addresses automatically as described in RFC 1256 on a per-interface basis. | An attacker who has gained control of a computer on the same network segment could configure a computer on the network to impersonate a router. Other computers with IRDP enabled would then attempt to route their traffic through the already compromised computer. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)' is set to 'Enabled'wt.windows.mss-legacy.safedllsearchmode-enable-safe-dll-search-mode-recommended | HIGH | The DLL search order can be configured to search for DLLs that are requested by running processes in one of two ways: • Search folders specified in the system path first, and then search the current working folder. • Search current working folder first, and then search the folders specified in the system path. When enabled, the registry value is set to 1. With a setting of 1, the system first searches the folders that are specified in the system path and then searches the current working folder. When disabled the registry value is set to 0 and the system first searches the current working folder and then searches the folders that are specified in the system path. Applications will be forced to search for DLLs in the system path first. For applications that require unique versions of these DLLs that are included with the application, this entry could cause performance or stability problems. Note: More information on how Safe DLL search mode works is available at this link: Dynamic-Link Library Search Order - Windows applications | Microsoft Docs | If a user unknowingly executes hostile code that was packaged with additional files that include modified versions of system DLLs, the hostile code could load its own versions of those DLLs and potentially increase the type and degree of damage the code can render. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)' is set to 'Enabled: 5 or fewer seconds'wt.windows.mss-legacy.screensavergraceperiod-the-time-in-seconds-before-the-screen-saver-grace-period-expires-0-recommended | HIGH | Windows includes a grace period between when the screen saver is launched and when the console is actually locked automatically when screen saver locking is enabled. | The default grace period that is allowed for user movement before the screen saver lock takes effect is five seconds. If you leave the default grace period configuration, your computer is vulnerable to a potential attack from someone who could approach the console and attempt to log on to the computer before the lock takes effect. An entry to the registry can be made to adjust the length of the grace period. | None - manual attestation (documented review step) |
Ensure 'MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted' is set to 'Enabled: 3'wt.windows.mss-legacy.tcpmaxdataretransmissions-how-many-times-unacknowledged-data-is-retransmitted | MEDIUM | This setting controls the number of times that TCP retransmits an individual data segment (non-connect segment) before the connection is aborted. The retransmission time-out is doubled with each successive retransmission on a connection. It is reset when responses resume. The base time-out value is dynamically determined by the measured round-trip time on the connection. | A malicious user could exhaust a target computer's resources if it never sent any acknowledgment messages for data that was transmitted by the target computer. | None - manual attestation (documented review step) |
Ensure 'MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted' is set to 'Enabled: 3'wt.windows.mss-legacy.tcpmaxdataretransmissions-ipv6-how-many-times-unacknowledged-data-is-retransmitted | MEDIUM | This setting controls the number of times that TCP retransmits an individual data segment (non-connect segment) before the connection is aborted. The retransmission time-out is doubled with each successive retransmission on a connection. It is reset when responses resume. The base time-out value is dynamically determined by the measured round-trip time on the connection. | A malicious user could exhaust a target computer's resources if it never sent any acknowledgment messages for data that was transmitted by the target computer. | None - manual attestation (documented review step) |
Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set to 'Enabled: 90% or less'wt.windows.mss-legacy.warninglevel-percentage-threshold-for-the-security-event-log-at-which-the-system-will-generate-a-warning | HIGH | This setting can generate a security audit in the Security event log when the log reaches a user-defined threshold. Note: If log settings are configured to Overwrite events as needed or Overwrite events older than x days, this event will not be generated. | If the Security log reaches 90 percent of its capacity and the computer has not been configured to overwrite events as needed, more recent events will not be written to the log. If the log reaches its capacity and the computer has been configured to shut down when it can no longer record events to the Security log, the computer will shut down and will no longer be available to provide network services. | None - manual attestation (documented review step) |
Ensure 'Prohibit installation and configuration of Network Bridge on your DNS domain network' is set to 'Enabled'wt.windows.network-connections.prohibit-installation-and-configuration-of-network-bridge-on-your-dns-domain-network | HIGH | You can use this procedure to control a user's ability to install and configure a Network Bridge. | The Network Bridge setting, if enabled, allows users to create a Layer 2 Media Access Control (MAC) bridge, enabling them to connect two or more physical network segments together. A Network Bridge thus allows a computer that has connections to two different networks to share data between those networks. In an enterprise managed environment, where there is a need to control network traffic to only authorized paths, allowing users to create a Network Bridge increases the risk and attack surface from the bridged network. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Prohibit use of Internet Connection Sharing on your DNS domain network' is set to 'Enabled'wt.windows.network-connections.prohibit-use-of-internet-connection-sharing-on-your-dns-domain-network | HIGH | Although this "legacy" setting traditionally applied to the use of Internet Connection Sharing (ICS) in Windows 2000, Windows XP & Server 2003, this setting now freshly applies to the Mobile Hotspot feature in Windows 10 & Server 2016. Warning: In order for Application Guard to function correctly, ICS must be enabled. If Application Guard is used in the environment, then an exception to this recommendation might be needed. To learn more on how to disable portions of ICS without breaking Application Guard, please visit: FAQ - Microsoft Defender Application Guard | Microsoft Learn. | Non-administrators should not be able to turn on the Mobile Hotspot feature and open their Internet connectivity up to nearby mobile devices. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require domain users to elevate when setting a network's location' is set to 'Enabled'wt.windows.network-connections.require-domain-users-to-elevate-when-setting-a-network-s-location | HIGH | This policy setting determines whether to require domain users to elevate when setting a network's location. | Allowing regular users to set a network location increases the risk and attack surface. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Hardened UNC Paths' is set to 'Enabled, with "Require Mutual Authentication", "Require Integrity", and “Require Privacy” set for all NETLOGON and SYSVOL shares'wt.windows.network-provider.hardened-unc-paths | HIGH | This policy setting configures secure access to UNC paths. Note: If the environment is 100% managed by Intune these shares will not be available. An exception to this recommendation will be needed. | In February 2015, Microsoft released a new control mechanism to mitigate a security risk in Group Policy as part of the MS15-011 / MSKB 3000483 security update. This mechanism requires both the installation of the new security update and also the deployment of specific group policy settings to all computers on the domain from Windows Vista / Server 2008 (non-R2) or newer (the associated security patch to enable this feature was not released for Server 2003). A new group policy template (NetworkProvider.admx/adml) was also provided with the security update. Once the new GPO template is in place, the following are the minimum requirements to remediate the Group Policy security risk: \\NETLOGON RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1 \\SYSVOL RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1 Note: A reboot may be required after the setting is applied to a client machine to access the above paths. Additional guidance on the deployment of this security setting is available from the Microsoft Premier Field Engineering (PFE) Platforms TechNet Blog here: Guidance on Deployment of MS15-011 and MS15-014. | None - manual attestation (documented review step) |
Ensure 'Prevent users from sharing files within their profile. (User)' is set to 'Enabled'wt.windows.network-sharing.prevent-users-from-sharing-files-within-their-profile-user | HIGH | This policy setting determines whether users can share files within their profile. By default, users are allowed to share files within their profile to other users on their network after an administrator opts in the computer. An administrator can opt in the computer by using the sharing wizard to share a file within their profile. | If not properly configured, a user could accidentally share sensitive data with unauthorized users. In an enterprise managed environment, the company should provide a managed location for file sharing, such as a file server or SharePoint, instead of the user sharing files directly from their own user profile. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Disallow Cloud Notification' is set to 'Allow'wt.windows.notifications.disallow-cloud-notification | MEDIUM | This policy setting blocks applications from using the network to send notifications to update tiles, tile badges, toast, or raw notifications. This policy setting turns off the connection between Windows and the Windows Push Notification Service (WNS). This policy setting also stops applications from being able to poll application services to update tiles. | Windows Push Notification Services (WNS) is a mechanism to receive third-party notifications and updates from the cloud/Internet. In a high security environment, external systems, especially those hosted outside the organization, should be prevented from having an impact on the secure workstations. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off toast notifications on the lock screen (User)' is set to 'Enabled'wt.windows.notifications.turn-off-toast-notifications-on-the-lock-screen-user | HIGH | This policy setting turns off toast notifications on the lock screen. | While this feature can be handy for users, applications that provide toast notifications might display sensitive personal or business data while the device is left unattended. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected operating system drives can be recovered' is set to 'Enabled'wt.windows.operating-system-drives.choose-how-bitlocker-protected-operating-system-drives-can-be-recovered | HIGH | This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker. The "Allow certificate-based data recovery agent" check box is used to specify whether a Data Recovery Agent can be used with BitLocker-protected operating system drives. Before a Data Recovery Agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding Data Recovery Agents. In "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. Select "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. In "Save BitLocker recovery information to Active Directory Domain Services", choose which BitLocker recovery information to store in AD DS for operating system drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only", only the recovery password is stored in AD DS. Select the "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. Note: If the "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives" check box is selected, a recovery password is automatically generated. | Should a user lose their primary means for accessing an encrypted OS volume, or should the system not pass its boot time integrity checks, the system will go into recovery mode. If the recovery key has not been backed up to Active Directory, the user would need to have saved the recovery key to another location such as a USB flash drive, or have printed the recovery password, and now have access to one of those in order to recovery the system. If the user is unable to produce the recovery key, then the user will be denied access to the encrypted volume and subsequently any data that is stored there. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent' is set to 'Enabled: False'wt.windows.operating-system-drives.choose-how-bitlocker-protected-operating-system-drives-can-be-recovered-allow-data-recovery-agent | HIGH | This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker. The "Allow certificate-based data recovery agent" check box is used to specify whether a Data Recovery Agent can be used with BitLocker-protected operating system drives. Before a Data Recovery Agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding Data Recovery Agents. | Should a user lose their primary means for accessing an encrypted OS volume, or should the system not pass its boot time integrity checks, the system will go into recovery mode. If the recovery key has not been backed up to Active Directory, the user would need to have saved the recovery key to another location such as a USB flash drive, or have printed the recovery password, and now have access to one of those in order to recovery the system. If the user is unable to produce the recovery key, then the user will be denied access to the encrypted volume and subsequently any data that is stored there. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS:' is set to 'Enabled: Store recovery passwords and key packages'wt.windows.operating-system-drives.choose-how-bitlocker-protected-operating-system-drives-can-be-recovered-configure-storage-of-bitlocker-recovery-information-to-ad-ds | HIGH | This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker. In "Save BitLocker recovery information to Active Directory Domain Services", choose which BitLocker recovery information to store in AD DS for operating system drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only", only the recovery password is stored in AD DS. | Should a user lose their primary means for accessing an encrypted OS volume, or should the system not pass its boot time integrity checks, the system will go into recovery mode. If the recovery key has not been backed up to Active Directory, the user would need to have saved the recovery key to another location such as a USB flash drive, or have printed the recovery password, and now have access to one of those in order to recovery the system. If the user is unable to produce the recovery key, then the user will be denied access to the encrypted volume and subsequently any data that is stored there. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives' is set to 'Enabled: True'wt.windows.operating-system-drives.choose-how-bitlocker-protected-operating-system-drives-can-be-recovered-do-not-enable-bitlocker-until-recovery-information-is-stored-to-ad-ds-for-operating-system-drives | HIGH | This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker. Select the "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. Note: If the "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives" check box is selected, a recovery password is automatically generated. | Should a user lose their primary means for accessing an encrypted OS volume, or should the system not pass its boot time integrity checks, the system will go into recovery mode. If the recovery key has not been backed up to Active Directory, the user would need to have saved the recovery key to another location such as a USB flash drive, or have printed the recovery password, and now have access to one of those in order to recovery the system. If the user is unable to produce the recovery key, then the user will be denied access to the encrypted volume and subsequently any data that is stored there. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives' is set to 'Enabled: True'wt.windows.operating-system-drives.choose-how-bitlocker-protected-operating-system-drives-can-be-recovered-do-not-enable-bitlocker-until-recovery-information-is-stored-to-ad-ds-for-operating-system-drives-4-11-7-2-8 | HIGH | This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker. In "Save BitLocker recovery information to Active Directory Domain Services", choose which BitLocker recovery information to store in AD DS for operating system drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only", only the recovery password is stored in AD DS. | Should a user lose their primary means for accessing an encrypted OS volume, or should the system not pass its boot time integrity checks, the system will go into recovery mode. If the recovery key has not been backed up to Active Directory, the user would need to have saved the recovery key to another location such as a USB flash drive, or have printed the recovery password, and now have access to one of those in order to recovery the system. If the user is unable to produce the recovery key, then the user will be denied access to the encrypted volume and subsequently any data that is stored there. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard' is set to 'Enabled: True'wt.windows.operating-system-drives.choose-how-bitlocker-protected-operating-system-drives-can-be-recovered-omit-recovery-options-from-the-bitlocker-setup-wizard | HIGH | This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker. Select "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. | Should a user lose their primary means for accessing an encrypted OS volume, or should the system not pass its boot time integrity checks, the system will go into recovery mode. If the recovery key has not been backed up to Active Directory, the user would need to have saved the recovery key to another location such as a USB flash drive, or have printed the recovery password, and now have access to one of those in order to recovery the system. If the user is unable to produce the recovery key, then the user will be denied access to the encrypted volume and subsequently any data that is stored there. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Recovery Key' is set to 'Enabled: Do not allow 256-bit recovery key'wt.windows.operating-system-drives.choose-how-bitlocker-protected-operating-system-drives-can-be-recovered-recovery-key | HIGH | This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker. In "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. | Should a user lose their primary means for accessing an encrypted OS volume, or should the system not pass its boot time integrity checks, the system will go into recovery mode. If the recovery key has not been backed up to Active Directory, the user would need to have saved the recovery key to another location such as a USB flash drive, or have printed the recovery password, and now have access to one of those in order to recovery the system. If the user is unable to produce the recovery key, then the user will be denied access to the encrypted volume and subsequently any data that is stored there. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Recovery Password' is set to 'Enabled: Require 48-digit recovery password'wt.windows.operating-system-drives.choose-how-bitlocker-protected-operating-system-drives-can-be-recovered-recovery-password | HIGH | This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker. In "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. | Should a user lose their primary means for accessing an encrypted OS volume, or should the system not pass its boot time integrity checks, the system will go into recovery mode. If the recovery key has not been backed up to Active Directory, the user would need to have saved the recovery key to another location such as a USB flash drive, or have printed the recovery password, and now have access to one of those in order to recovery the system. If the user is unable to produce the recovery key, then the user will be denied access to the encrypted volume and subsequently any data that is stored there. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enforce drive encryption type on operating system drives: Select the encryption type: (device)' is set to 'Enabled: Used Space Only encryption' or 'Enabled: Full encryption'wt.windows.operating-system-drives.enforce-drive-encryption-type-on-operating-system-drives-select-the-encryption-type-device | HIGH | This policy setting configures the encryption type (space only and whole) used by BitLocker Drive Encryption. Note: Changing the encryption type does not affect drives that are already encrypted or if encryption is in progress. Note #2: If the option full encryption is selected, the entire drive be encrypted. If the option used space only encryption is selected, only the portion of the drive used to store data will be encrypted. | The type of encryption (space only or whole) used by BitLocker should be an organizational decision and not an end user decision. | None - manual attestation (documented review step) |
Ensure 'Require additional authentication at startup' is set to 'Enabled'wt.windows.operating-system-drives.require-additional-authentication-at-startup | HIGH | This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker. Note: Only one of the additional authentication options can be required at startup, otherwise a policy error occurs. If you want to use BitLocker on a computer without a TPM, select the "Allow BitLocker without a compatible TPM" check box. In this mode a USB drive is required for start-up and the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable you will need to use one of the BitLocker recovery options to access the drive. On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 4-digit to 20-digit personal identification number (PIN), or both. Users can configure advanced startup options in the BitLocker setup wizard. Note #2: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard. | TPM without use of a PIN will only validate early boot components and does not require a user to enter any additional authentication information. If a computer is lost or stolen in this configuration, BitLocker will not provide any additional measure of protection beyond what is provided by native Windows authentication unless the early boot components are tampered with or the encrypted drive is removed from the machine. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require additional authentication at startup: Configure TPM startup:' is set to 'Enabled: Do not allow TPM'wt.windows.operating-system-drives.require-additional-authentication-at-startup-configure-tpm-startup | HIGH | This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts. This policy setting is applied when you turn on BitLocker. Note: Only one of the additional authentication options can be required at startup, otherwise a policy error occurs. On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 4-digit to 20-digit personal identification number (PIN), or both. Warning: If silent encryption is desired, this setting must be configured to Require TPM and an exception to this recommendation will be needed. Please also see recommendation 'Require additional authentication at startup: Configure TPM startup PIN:' is set to 'Enabled: Require startup PIN with TPM' for needed configuration change for silent encryption. | TPM without use of a PIN will only validate early boot components and does not require a user to enter any additional authentication information. If a computer is lost or stolen in this configuration, BitLocker will not provide any additional measure of protection beyond what is provided by native Windows authentication unless the early boot components are tampered with or the encrypted drive is removed from the machine. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require additional authentication at startup: Configure TPM startup key:' is set to 'Enabled: Do not allow startup key with TPM'wt.windows.operating-system-drives.require-additional-authentication-at-startup-configure-tpm-startup-key | HIGH | This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts. This policy setting is applied when you turn on BitLocker. Note: Only one of the additional authentication options can be required at startup, otherwise a policy error occurs. On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 4-digit to 20-digit personal identification number (PIN), or both. Note #2: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard. | TPM without use of a PIN will only validate early boot components and does not require a user to enter any additional authentication information. If a computer is lost or stolen in this configuration, BitLocker will not provide any additional measure of protection beyond what is provided by native Windows authentication unless the early boot components are tampered with or the encrypted drive is removed from the machine. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require additional authentication at startup: Configure TPM startup key and PIN:' is set to 'Enabled: Do not allow startup key and PIN with TPM'wt.windows.operating-system-drives.require-additional-authentication-at-startup-configure-tpm-startup-key-and-pin | HIGH | This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts. This policy setting is applied when you turn on BitLocker. Note: Only one of the additional authentication options can be required at startup, otherwise a policy error occurs. On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 4-digit to 20-digit personal identification number (PIN), or both. Note #2: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard. | TPM without use of a PIN will only validate early boot components and does not require a user to enter any additional authentication information. If a computer is lost or stolen in this configuration, BitLocker will not provide any additional measure of protection beyond what is provided by native Windows authentication unless the early boot components are tampered with or the encrypted drive is removed from the machine. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require additional authentication at startup: Configure TPM startup PIN:' is set to 'Enabled: Require startup PIN with TPM'wt.windows.operating-system-drives.require-additional-authentication-at-startup-configure-tpm-startup-pin | HIGH | This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts. This policy setting is applied when you turn on BitLocker. Note: Only one of the additional authentication options can be required at startup, otherwise a policy error occurs. On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 4-digit to 20-digit personal identification number (PIN), or both. Warning: If silent encryption is desired, this setting must be configured to Do not allow startup PIN with TPM and an exception to this recommendation will be needed. Please also see recommendation Require additional authentication at startup: Configure TPM startup:' is set to 'Enabled: Do not allow TPM' for needed configuration change for silent encryption. | TPM without use of a PIN will only validate early boot components and does not require a user to enter any additional authentication information. If a computer is lost or stolen in this configuration, BitLocker will not provide any additional measure of protection beyond what is provided by native Windows authentication unless the early boot components are tampered with or the encrypted drive is removed from the machine. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Prevent enabling lock screen camera' is set to 'Enabled'wt.windows.personalization.prevent-enabling-lock-screen-camera | HIGH | Disables the lock screen camera toggle switch in PC Settings and prevents a camera from being invoked on the lock screen. | Disabling the lock screen camera extends the protection afforded by the lock screen to camera features. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Prevent enabling lock screen slide show' is set to 'Enabled'wt.windows.personalization.prevent-enabling-lock-screen-slide-show | HIGH | Disables the lock screen slide show settings in PC Settings and prevents a slide show from playing on the lock screen. | Disabling the lock screen slide show extends the protection afforded by the lock screen to slide show contents. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Prevent Codec Download (User)' is set to 'Enabled'wt.windows.playback.prevent-codec-download-user | MEDIUM | This setting controls whether Windows Media Player is allowed to download additional codecs for decoding media files it does not already understand. | This has some potential for risk if a malicious data file is opened in Media Player that requires an additional codec to be installed. If a special codec is required for a necessary job function, then that codec should first be tested to ensure it is legitimate, and it should be supplied by the IT department in the organization. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Print Spooler to accept client connections' is set to 'Disabled'wt.windows.printers.allow-print-spooler-to-accept-client-connections | HIGH | This policy setting controls whether the Print Spooler service will accept client connections. Note: The Print Spooler service must be restarted for changes to this policy to take effect. | Disabling the ability for the Print Spooler service to accept client connections mitigates remote attacks against the PrintNightmare vulnerability (CVE-2021-34527) and other remote Print Spooler attacks. However, this recommendation does not mitigate against local attacks on the Print Spooler service. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure Redirection Guard: Redirection Guard Options' is set to 'Enabled: Redirection Guard Enabled'wt.windows.printers.configure-redirection-guard-redirection-guard-options | HIGH | This policy setting determines whether Redirection Guard is enabled for the print spooler. Redirection Guard can prevent file redirections from being used within the print spooler. | This setting prevents non-administrators from redirecting files within the print spooler process. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure RPC connection settings: Protocol to use for outgoing RPC connections' is set to 'Enabled: RPC over TCP'wt.windows.printers.configure-rpc-connection-settings-protocol-to-use-for-outgoing-rpc-connections | HIGH | This policy setting controls which protocol and protocol settings to use for outgoing Remote Procedure Call (RPC) connections to a remote print spooler. The recommended state for this setting is: Enabled: RPC over TCP | This setting prevents the use of named pipes for RPC connections to the print spooler and forces the use of TCP which is a more secure communication method. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure RPC connection settings: Use authentication for outgoing RPC connections' is set to 'Enabled: Default'wt.windows.printers.configure-rpc-connection-settings-use-authentication-for-outgoing-rpc-connections | HIGH | This policy setting controls which protocol and protocol settings to use for outgoing Remote Procedure Call (RPC) connections to a remote print spooler. The recommended state for this setting is: Enabled: Default | This setting can prevent the use of named pipes for RPC connections to the print spooler and forces the use of TCP which is a more secure communication method. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure RPC listener settings: Authentication protocol to use for incoming RPC connections:' is set to 'Enabled: Negotiate' or higherwt.windows.printers.configure-rpc-listener-settings-configure-protocol-options-for-incoming-rpc-connections | HIGH | This policy setting controls which protocols incoming Remote Procedure Call (RPC) connections to the print spooler are allowed to use. | This setting can prevent the use of named pipes for RPC connections to the print spooler and forces the use of TCP which is a more secure communication method. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure RPC listener settings: Protocols to allow for incoming RPC connections' is set to 'Enabled: RPC over TCP'wt.windows.printers.configure-rpc-listener-settings-configure-protocol-options-for-incoming-rpc-connections-4-7-6 | HIGH | This policy setting controls which protocols incoming Remote Procedure Call (RPC) connections to the print spooler are allowed to use. | This setting can prevent the use of named pipes for RPC connections to the print spooler and forces the use of TCP which is a more secure communication method. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure RPC over TCP port: RPC over TCP port:' is set to 'Enabled: 0'wt.windows.printers.configure-rpc-over-tcp-port-rpc-over-tcp-port | HIGH | This policy setting controls which port is used for RPC over TCP for incoming connections to the print spooler and outgoing connections to remote print spoolers. | Using dynamic ports for printing makes it more difficult for an attacker to know which port is being used and therefore which port to attack. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Limits print driver installation to Administrators' is set to 'Enabled'wt.windows.printers.limits-print-driver-installation-to-administrators | HIGH | This policy setting controls whether users who aren't Administrators can install print drivers on the system. Note: On August 10, 2021, Microsoft announced a Point and Print Default Behavior Change which modifies the default Point and Print driver installation and update behavior to require Administrator privileges. This is documented in KB5005652- Manage new Point and Print default driver installation behavior (CVE-2021-34481). | Restricting the installation of print drives to Administrators can help mitigate the PrintNightmare vulnerability (CVE-2021-34527) and other Print Spooler attacks. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Manage processing of Queue-specific files: Manage processing of Queue-Specific files' is set to 'Enabled: Limit Queue-specific files to Color profiles'wt.windows.printers.manage-processing-of-queue-specific-files-manage-processing-of-queue-specific-files | HIGH | This policy setting manages how queue-specific files are processed during printer installation. At printer installation time, a vendor-supplied installation application can specify a set of files, of any type, to be associated with a particular print queue. The files are downloaded to each client that connects to the print server. | A Windows Print Spooler Remote Code Execution Vulnerability (CVE-2021-36958) exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploits this vulnerability could run arbitrary code with SYSTEM privileges and then install programs; view, change, or delete data; or create new accounts with full user rights. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Point and Print Restrictions: When installing drivers for a new connection' is set to 'Enabled: Show warning and elevation prompt'wt.windows.printers.point-and-print-restrictions-when-installing-drivers-for-a-new-connection | HIGH | This policy setting controls whether computers will show a warning and a security elevation prompt when users create a new printer connection using Point and Print. Note: On August 10, 2021, Microsoft announced a Point and Print Default Behavior Change which modifies the default Point and Print driver installation and update behavior to require Administrator privileges. This is documented in KB5005652- Manage new Point and Print default driver installation behavior (CVE-2021-34481). This change overrides all Point and Print Group Policy settings and ensures that only Administrators can install printer drivers from a print server using Point and Print. | Enabling Windows User Account Control (UAC) for the installation of new print drivers can help mitigate the PrintNightmare vulnerability (CVE-2021-34527) and other Print Spooler attacks. Although the Point and Print default driver installation behavior overrides this setting, it is important to configure this as a backstop in the event that behavior is reversed. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Point and Print Restrictions: When updating drivers for an existing connection' is set to 'Enabled: Show warning and elevation prompt'wt.windows.printers.point-and-print-restrictions-when-updating-drivers-for-an-existing-connection | HIGH | This policy setting controls whether computers will show a warning and a security elevation prompt when users are updating drivers for an existing connection using Point and Print. Note: On August 10, 2021, Microsoft announced a Point and Print Default Behavior Change which modifies the default Point and Print driver installation and update behavior to require Administrator privileges. This is documented in KB5005652- Manage new Point and Print default driver installation behavior (CVE-2021-34481). This change overrides all Point and Print Group Policy settings and ensures that only Administrators can install printer drivers from a print server using Point and Print. | Enabling Windows User Account Control (UAC) for updating existing print drivers can help mitigate the PrintNightmare vulnerability (CVE-2021-34527) and other Print Spooler attacks. Although the Point and Print default driver installation behavior overrides this setting, it is important to configure this as a backstop in the event that behavior is reversed. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Cross Device Clipboard' is set to 'Block'wt.windows.privacy.allow-cross-device-clipboard | MEDIUM | This setting determines whether Clipboard contents can be synchronized across devices. | In high security environments, clipboard data should stay local to the system and not synced across devices, as it may contain very sensitive information that must be contained locally. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Input Personalization' is set to 'Block'wt.windows.privacy.allow-input-personalization | HIGH | This policy enables the automatic learning component of input personalization that includes speech, inking, and typing. Automatic learning enables the collection of speech and handwriting patterns, typing history, contacts, and recent calendar information. It is required for the use of Cortana. Some of this collected information may be stored on the user's OneDrive, in the case of inking and typing; some of the information will be uploaded to Microsoft to personalize speech. | If this setting is Enabled sensitive information could be stored in the cloud or sent to Microsoft. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Disable Advertising ID' is set to 'Enabled'wt.windows.privacy.disable-advertising-id | MEDIUM | This policy setting turns off the advertising ID, preventing apps from using the ID for experiences across apps. | Tracking user activity for advertising purposes, even anonymously, may be a privacy concern. In an enterprise managed environment, applications should not need or require tracking for targeted advertising. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Let Apps Activate With Voice Above Lock' is set to 'Enabled: Force Deny'wt.windows.privacy.let-apps-activate-with-voice-above-lock | HIGH | This policy setting specifies whether Windows apps can be activated by voice (apps and Cortana) while the system is locked. | Access to any computer resource should not be allowed when the device is locked. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Upload User Activities' is set to 'Disabled'wt.windows.privacy.upload-user-activities | MEDIUM | This policy setting determines whether published User Activities can be uploaded to the cloud. | Due to privacy concerns, data should never be sent to any third-party since this data could contain sensitive information. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off Push To Install service' is set to 'Enabled'wt.windows.push-to-install.turn-off-push-to-install-service | MEDIUM | This policy setting controls whether users can push Apps to the device from the Microsoft Store App running on other devices or the web. | In a high security managed environment, application installations should be managed centrally by IT staff, not by end users. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure Offer Remote Assistance' is set to 'Disabled'wt.windows.remote-assistance.configure-offer-remote-assistance | HIGH | This policy setting allows you to turn on or turn off Offer (Unsolicited) Remote Assistance on this computer. Help desk and support personnel will not be able to proactively offer assistance, although they can still respond to user assistance requests. | A user might be tricked and accept an unsolicited Remote Assistance offer from a malicious user. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure Solicited Remote Assistance' is set to 'Disabled'wt.windows.remote-assistance.configure-solicited-remote-assistance | HIGH | This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer. | There is slight risk that a rogue administrator will gain access to another user's desktop session, however, they cannot connect to a user's computer unannounced or control it without permission from the user. When an expert tries to connect, the user can still choose to deny the connection or give the expert view-only privileges. The user must explicitly click the Yes button to allow the expert to remotely control the workstation. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Do not allow passwords to be saved' is set to 'Enabled'wt.windows.remote-desktop-connection-client.do-not-allow-passwords-to-be-saved | HIGH | This policy setting helps prevent Remote Desktop clients from saving passwords on a computer. Note: If this policy setting was previously configured as Disabled or Not configured, any previously saved passwords will be deleted the first time a Remote Desktop client disconnects from any server. | An attacker with physical access to the computer may be able to break the protection guarding saved passwords. An attacker who compromises a user's account and connects to their computer could use saved passwords to gain access to additional hosts. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable RPC Endpoint Mapper Client Authentication' is set to 'Enabled'wt.windows.remote-procedure-call.enable-rpc-endpoint-mapper-client-authentication | HIGH | This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the call they are making contains authentication information. The Endpoint Mapper Service on computers running Windows NT4 (all service packs) cannot process authentication information supplied in this manner. This policy setting can cause a specific issue with 1-way forest trusts if it is applied to the trusting domain DCs (see Microsoft KB3073942), so we do not recommend applying it to Domain Controllers. Note: This policy will not in effect until the system is rebooted. | Anonymous access to RPC services could result in accidental disclosure of information to unauthenticated users. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Restrict Unauthenticated RPC clients' is set to 'Enabled: Authenticated'wt.windows.remote-procedure-call.restrict-unauthenticated-rpc-clients | HIGH | This policy setting controls how the RPC server runtime handles unauthenticated RPC clients connecting to RPC servers. This policy setting impacts all RPC applications. In a domain environment this policy setting should be used with caution as it can impact a wide range of functionality including group policy processing itself. Reverting a change to this policy setting can require manual intervention on each affected machine. This policy setting should never be applied to a Domain Controller. A client will be considered an authenticated client if it uses a named pipe to communicate with the server or if it uses RPC Security. RPC Interfaces that have specifically requested to be accessible by unauthenticated clients may be exempt from this restriction, depending on the selected value for this policy setting. -- "None" allows all RPC clients to connect to RPC Servers running on the machine on which the policy setting is applied. -- "Authenticated" allows only authenticated RPC Clients (per the definition above) to connect to RPC Servers running on the machine on which the policy setting is applied. Exemptions are granted to interfaces that have requested them. -- "Authenticated without exceptions" allows only authenticated RPC Clients (per the definition above) to connect to RPC Servers running on the machine on which the policy setting is applied. No exceptions are allowed. This value has the potential to cause serious problems and is not recommended. Note: This policy setting will not be applied until the system is rebooted. | Unauthenticated RPC communication can create a security vulnerability. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Deny write access to removable drives not protected by BitLocker' is set to 'Enabled'wt.windows.removable-data-drives.deny-write-access-to-removable-drives-not-protected-by-bitlocker | HIGH | This policy setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive. All removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. | Users may not voluntarily encrypt removable drives prior to saving important data to the drive. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Deny write access to removable drives not protected by BitLocker: Do not allow write access to devices configured in another organization' is set to 'Enabled: False'wt.windows.removable-data-drives.deny-write-access-to-removable-drives-not-protected-by-bitlocker-do-not-allow-write-access-to-devices-configured-in-another-organization | HIGH | This policy setting configures whether the computer will be able to write data to BitLocker-protected removable drives that were configured in another organization. | Restricting write access to BitLocker-protected removable drives that were configured in another organization can hinder legitimate business operations where encrypted data sharing is necessary. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Configure Watson events' is set to 'Disabled'wt.windows.reporting.configure-watson-events | MEDIUM | This policy setting allows you to configure whether or not Watson events are sent. | Watson events are the reports that get sent to Microsoft when a program or service crashes or fails, including the possibility of automatic submission. Preventing this information from being sent can help reduce privacy concerns. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Prevent downloading of enclosures' is set to 'Enabled'wt.windows.rss-feeds.prevent-downloading-of-enclosures | HIGH | This policy setting prevents the user from having enclosures (file attachments) downloaded from an RSS feed to the user's computer. | Allowing attachments to be downloaded through the RSS feed can introduce files that could have malicious intent. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Cloud Search' is set to 'Not allowed'wt.windows.search.allow-cloud-search | MEDIUM | This policy setting allows search and Cortana to search cloud sources like OneDrive and SharePoint. | Due to privacy concerns, data should never be sent to any third-party since this data could contain sensitive information. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Indexing Encrypted Stores Or Items' is set to 'Block'wt.windows.search.allow-indexing-encrypted-stores-or-items | HIGH | This policy setting controls whether encrypted items are allowed to be indexed. When this setting is changed, the index is rebuilt completely. Full volume encryption (such as BitLocker Drive Encryption or a non-Microsoft solution) must be used for the location of the index to maintain security for encrypted files. | Indexing and allowing users to search encrypted files could potentially reveal confidential data stored within the encrypted files. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow search highlights' is set to '0' (Automated)wt.windows.search.allow-search-highlights | MEDIUM | This policy setting controls search highlights in the start menu search box and in search home. Note: As of February 2024 this setting does not deploy correctly on Windows 10 via Intune and only applies to Windows 11. | In a high security environment, data should never be sent to or received by any third- party since this data could contain sensitive information. | None - manual attestation (documented review step) |
Ensure 'Allow Search To Use Location' is set to 'Block'wt.windows.search.allow-search-to-use-location | HIGH | This policy setting specifies whether search and Cortana can provide location aware search and Cortana results. | In an enterprise managed environment, allowing Cortana and Search to have access to location data is unnecessary. Organizations likely do not want this information shared out. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Always prompt for password upon connection' is set to 'Enabled'wt.windows.security.always-prompt-for-password-upon-connection | HIGH | This policy setting specifies whether Remote Desktop Services always prompts the client computer for a password upon connection. You can use this policy setting to enforce a password prompt for users who log on to Remote Desktop Services, even if they already provided the password in the Remote Desktop Connection client. | Users have the option to store both their username and password when they create a new Remote Desktop Connection shortcut. If the server that runs Remote Desktop Services allows users who have used this feature to log on to the server but not enter their password, then it is possible that an attacker who has gained physical access to the user's computer could connect to a Remote Desktop Server through the Remote Desktop Connection shortcut, even though they may not know the user's password. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'wt.windows.security.control-event-log-behavior-when-the-log-file-reaches-its-maximum-size | HIGH | Controls what the Security event log does once it reaches its configured maximum size. When disabled, the log overwrites the oldest events as needed instead of refusing new events. | The Security log is the canonical source for logon, privilege use, object access, and policy-change events that incident responders rely on. An attacker who can fill it would block further evidence collection during their post-exploitation activity, so allowing roll-over keeps recent events captured even when archive jobs lag. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require secure RPC communication' is set to 'Enabled'wt.windows.security.require-secure-rpc-communication | HIGH | This policy setting allows you to specify whether Remote Desktop Services requires secure Remote Procedure Call (RPC) communication with all clients or allows unsecured communication. You can use this policy setting to strengthen the security of RPC communication with clients by allowing only authenticated and encrypted requests. | Allowing unsecure RPC communication can exposes the server to man in the middle attacks and data disclosure attacks. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL'wt.windows.security.require-use-of-specific-security-layer-for-remote-rdp-connections | HIGH | This policy setting specifies whether to require the use of a specific security layer to secure communications between clients and RD Session Host servers during Remote Desktop Protocol (RDP) connections. Note: In spite of this setting being labeled SSL, it is actually enforcing Transport Layer Security (TLS), not the older and less secure, Secure Socket Layer (SSL) protocol. | The native RDP encryption is now considered a weak protocol, so enforcing the use of stronger TLS encryption for all RDP communications between clients and RD Session Host servers is preferred. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require user authentication for remote connections by using Network Level Authentication' is set to 'Enabled'wt.windows.security.require-user-authentication-for-remote-connections-by-using-network-level-authentication | HIGH | This policy setting allows you to specify whether to require user authentication for remote connections to the RD Session Host server by using Network Level Authentication. | Requiring that user authentication occur earlier in the remote connection process enhances security. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Set client connection encryption level' is set to 'Enabled: High Level'wt.windows.security.set-client-connection-encryption-level | HIGH | This policy setting specifies whether to require the use of a specific encryption level to secure communications between client computers and RD Session Host servers during Remote Desktop Protocol (RDP) connections. This policy only applies when you are using native RDP encryption. However, native RDP encryption (as opposed to SSL encryption) is not recommended. This policy does not apply to SSL encryption. | If Remote Desktop client connections that use low level encryption are allowed, it is more likely that an attacker will be able to decrypt any captured Remote Desktop Services network traffic. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 196,608 or greater'wt.windows.security.specify-the-maximum-log-file-size-kb | HIGH | This policy setting specifies the maximum size of the log file in kilobytes. The maximum log file size can be configured between 1 megabyte (1,024 kilobytes) and 4 terabytes (4,194,240 kilobytes) in kilobyte increments. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users. | None - manual attestation (documented review step) |
Ensure 'Set time limit for active but idle Remote Desktop Services sessions' is set to 'Enabled: 15 minutes or less, but not Never (0)'wt.windows.session-time-limits.set-time-limit-for-active-but-idle-remote-desktop-services-sessions | MEDIUM | This policy setting allows you to specify the maximum amount of time that an active Remote Desktop Services session can be idle (without user input) before it is automatically disconnected. | This setting helps to prevent active Remote Desktop sessions from tying up the computer for long periods of time while not in use, preventing computing resources from being consumed by large numbers of inactive sessions. In addition, old, forgotten Remote Desktop sessions that are still active can cause password lockouts if the user's password has changed but the old session is still running. For systems that limit the number of connected users (e.g. servers in the default Administrative mode - 2 sessions only), other users' old but still active sessions can prevent another user from connecting, resulting in an effective denial of service. In addition, session timeouts that are misconfigured or set for a long period of time can leave the system open to an attacker hijacking the session. | None - manual attestation (documented review step) |
Ensure 'Set time limit for disconnected sessions' is set to 'Enabled: 1 minute'wt.windows.session-time-limits.set-time-limit-for-disconnected-sessions | MEDIUM | This policy setting allows you to configure a time limit for disconnected Remote Desktop Services sessions. | This setting helps to prevent active Remote Desktop sessions from tying up the computer for long periods of time while not in use, preventing computing resources from being consumed by large numbers of disconnected but still active sessions. In addition, old, forgotten Remote Desktop sessions that are still active can cause password lockouts if the user's password has changed but the old session is still running. For systems that limit the number of connected users (e.g. servers in the default Administrative mode - 2 sessions only), other users' old but still active sessions can prevent another user from connecting, resulting in an effective denial of service. This setting is important to ensure a disconnected session is properly terminated. In addition, session timeouts that are misconfigured or set for a long period of time can leave the system open to an attacker hijacking the session. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Online Tips' is set to 'Block' (Automated)wt.windows.settings.allow-online-tips | MEDIUM | This policy setting configures the retrieval of online tips and help for the Settings app. | Due to privacy concerns, data should never be sent to any third-party since this data could contain sensitive information. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'wt.windows.setup.control-event-log-behavior-when-the-log-file-reaches-its-maximum-size | HIGH | Controls what the Setup event log does once it reaches its configured maximum size. When disabled, the log overwrites the oldest events as needed instead of refusing new events. | The Setup log carries install, servicing, and feature-update events that are needed to triage failed patches or to detect tampering with the update pipeline. Allowing roll-over preserves the most recent setup activity even when retention or archival is misconfigured. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater'wt.windows.setup.specify-the-maximum-log-file-size-kb | HIGH | This policy setting specifies the maximum size of the log file in kilobytes. The maximum log file size can be configured between 1 megabyte (1,024 kilobytes) and 4 terabytes (4,194,240 kilobytes) in kilobyte increments. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users | None - manual attestation (documented review step) |
Ensure 'Require a password when a computer wakes (on battery)' is set to 'Enabled'wt.windows.sleep-settings.require-a-password-when-a-computer-wakes-on-battery | HIGH | Specifies whether or not the user is prompted for a password when the system resumes from sleep. | Enabling this setting ensures that anyone who wakes an unattended computer from sleep state will have to provide logon credentials before they can access the system. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require a password when a computer wakes (plugged in)' is set to 'Enabled'wt.windows.sleep-settings.require-a-password-when-a-computer-wakes-plugged-in | HIGH | Specifies whether or not the user is prompted for a password when the system resumes from sleep. | Enabling this setting ensures that anyone who wakes an unattended computer from sleep state will have to provide logon credentials before they can access the system. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off the offer to update to the latest version of Windows' is set to 'Enabled'wt.windows.store.turn-off-the-offer-to-update-to-the-latest-version-of-windows | HIGH | Enables or disables the Microsoft Store offer to update to the latest version of Windows. | Unplanned OS upgrades can lead to more preventable support calls. The IT department should be managing and approving all upgrades and updates. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn off the Store application' is set to 'Enabled'wt.windows.store.turn-off-the-store-application | MEDIUM | This setting denies or allows access to the Store application. Note: Per Microsoft TechNet and MSKB 3135657, this policy setting does not apply to any Windows 10 editions other than Enterprise and Education. | Only applications approved by an IT department should be installed. Allowing users to install third-party applications can lead to missed patches and potential zero day vulnerabilities. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Sudo' is set to 'Sudo is disabled'wt.windows.sudo.enable-sudo | HIGH | This policy setting configures the use of the sudo.exe command line tool. The sudo feature in Windows allows users to run elevated commands (as an administrator) directly from an unelevated console session. | Sudo for Windows could be exploited for escalation of privilege and spoofing attacks by a malicious actor. For example, in October 2024, CVE-2024-43571 (spoofing vulnerability) was created by Microsoft. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Backup Directory' is set to 'Backup the password to Azure AD only'wt.windows.system-services.backup-directory | HIGH | This policy setting configures which directory Windows LAPS will use to back up the local admin account password. Note: Organizations that utilize third-party commercial software to manage unique & complex local Administrator passwords on domain members may opt to disregard these LAPS recommendations. • Windows LAPS does not support standalone computers - they must be joined to an Active Directory domain or Entra ID (formerly Azure Active Directory). • Windows LAPS does not support simultaneous storage of the local admin password in both directory types. • If the setting is configured and the managed device is not joined to the configured directory type, the local administrator password will not be managed by Windows LAPS. Important: An organization wishing to use Active Directory to backup the LAPS password may make an exception for this recommendation. To implement Active Directory backup see the latest on-premises CIS Benchmark for Windows 10/11. When backing up with Active Directory there are 2 additional security controls to be considered in the benchmark which are not available when using Azure AD for backup. These were excluded from the Intune benchmark as they cannot be selected unless Active Directory is selected as the backup location. | Due to the difficulty in managing local Administrator passwords, many organizations choose to use the same password on all workstations and/or Member Servers when deploying them. This creates a serious attack surface security risk because if an attacker manages to compromise one system and learn the password to its local Administrator account, then they can leverage that account to instantly gain access to all other computers that also use that password for their local Administrator account. | None - manual attestation (documented review step) |
Ensure 'Bluetooth Audio Gateway Service (BTAGService)' is set to 'Disabled'wt.windows.system-services.bluetooth-audio-gateway-service-btagservice | MEDIUM | Service supporting the audio gateway role of the Bluetooth Handsfree Profile. | Bluetooth technology has inherent security risks - especially prior to the v2.1 standard. Wireless Bluetooth traffic is not well encrypted (if at all), so in a high-security environment, it should not be permitted, in spite of the added inconvenience of not being able to use Bluetooth devices. | None - manual attestation (documented review step) |
Ensure 'Bluetooth Support Service (bthserv)' is set to 'Disabled'wt.windows.system-services.bluetooth-support-service-bthserv | MEDIUM | The Bluetooth service supports discovery and association of remote Bluetooth devices. | Bluetooth technology has inherent security risks - especially prior to the v2.1 standard. Wireless Bluetooth traffic is not well encrypted (if at all), so in a high-security environment, it should not be permitted, in spite of the added inconvenience of not being able to use Bluetooth devices. | None - manual attestation (documented review step) |
Ensure 'Computer Browser (Browser)' is set to 'Disabled' or 'Not Installed'wt.windows.system-services.computer-browser-browser | HIGH | Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. Note: In Windows 8.1 and Windows 10, this service is bundled with the SMB 1.0/CIFS File Sharing Support optional feature. As a result, removing that feature (highly recommended unless backward compatibility is needed to XP/2003 and older Windows OSes - see Stop using SMB1 | Storage at Microsoft) will also remediate this recommendation. The feature is not installed by default starting with Windows 10 R1709. | This is a legacy service - its sole purpose is to maintain a list of computers and their network shares in the environment (i.e. "Network Neighborhood"). If enabled, it generates a lot of unnecessary traffic, including "elections" to see who gets to be the "master browser". This noisy traffic could also aid malicious attackers in discovering online machines, because the service also allows anyone to "browse" for shared resources without any authentication. This service used to be running by default in older Windows versions (e.g. Windows XP), but today it only remains for backward compatibility for very old software that requires it. | None - manual attestation (documented review step) |
Ensure 'Downloaded Maps Manager (MapsBroker)' is set to 'Disabled'wt.windows.system-services.downloaded-maps-manager-mapsbroker | MEDIUM | Windows service for application access to downloaded maps. This service is started on- demand by application accessing downloaded maps. | Mapping technologies can unwillingly reveal your location to attackers and other software that picks up the information. In addition, automatic downloads of data from third-party sources should be minimized when not needed. Therefore, this service should not be needed in high security environments. | None - manual attestation (documented review step) |
Ensure 'GameInput Service (GameInputSvc)' is set to 'Disabled'wt.windows.system-services.gameinput-service-gameinputsvc | MEDIUM | This service enables the use of keyboards, mice, gamepads, and other input devices to be used with the GameInput API. Note: GameInput service runs as LocalSystem in its own process of GameInputSvc.exe and doesn't share its process with other services. | GameInput API pipes input from keyboards, mice, gamepads, and other game controllers via Direct Memory Access (DMA) to decrease latency for gaming performance. This DMA use increases the risk of input data (especially keystrokes) being captured by a malicious attacker. | None - manual attestation (documented review step) |
Ensure 'Geolocation Service (lfsvc)' is set to 'Disabled'wt.windows.system-services.geolocation-service-lfsvc | MEDIUM | This service monitors the current location of the system and manages geofences (a geographical location with associated events). | This setting affects the location feature (e.g. GPS or other location tracking). From a security perspective, it’s not a good idea to reveal your location to software in most cases, but there are legitimate uses, such as mapping software. However, they should not be used in high security environments. | None - manual attestation (documented review step) |
Ensure 'IIS Admin Service (IISADMIN)' is set to 'Disabled' or 'Not Installed'wt.windows.system-services.iis-admin-service-iisadmin | HIGH | Enables the server to administer the IIS metabase. The IIS metabase stores configuration for the SMTP and FTP services. Note: This service is not installed by default. It is supplied with Windows, but is installed by enabling an optional Windows feature (Internet Information Services). Note #2: An organization may choose to selectively grant exceptions to web developers to allow IIS (or another web server) on their workstation, in order for them to locally test & develop web pages. However, the organization should track those machines and ensure the security controls and mitigations are kept up to date, to reduce risk of compromise. | Hosting a website from a workstation is an increased security risk, as the attack surface of that workstation is then greatly increased. If proper security mitigations are not followed, the chance of successful attack increases significantly. Note: This security concern applies to any web server application installed on a workstation, not just IIS. | None - manual attestation (documented review step) |
Ensure 'Infrared monitor service (irmon)' is set to 'Disabled' or 'Not Installed'wt.windows.system-services.infrared-monitor-service-irmon | HIGH | Detects other Infrared devices that are in range and launches the file transfer application. | Infrared connections can potentially be a source of data compromise - especially via the automatic "file transfer application" functionality. Enterprise-managed systems should utilize a more secure method of connection than infrared. | None - manual attestation (documented review step) |
Ensure 'Link-Layer Topology Discovery Mapper (lltdsvc)' is set to 'Disabled'wt.windows.system-services.link-layer-topology-discovery-mapper-lltdsvc | MEDIUM | Creates a Network Map, consisting of PC and device topology (connectivity) information, and metadata describing each PC and device. | The feature that this service enables could potentially be used for unauthorized discovery and connection to network devices. Disabling the service helps to prevent responses to requests for network topology discovery in high security environments. | None - manual attestation (documented review step) |
Ensure 'LxssManager (LxssManager)' is set to 'Disabled' or 'Not Installed'wt.windows.system-services.lxssmanager-lxssmanager | HIGH | The LXSS Manager service supports running native ELF binaries. The service provides the infrastructure necessary for ELF binaries to run on Windows. Note: This service is not installed by default. It is supplied with Windows, but is installed by enabling an optional Windows feature (Windows Subsystem for Linux). | The Linux Subsystem (LXSS) Manager allows full system access to Linux applications on Windows, including the file system. While this can certainly have some functionality and performance benefits for running those applications, it also creates new security risks in the event that a hacker injects malicious code into a Linux application. For best security, it is preferred to run Linux applications on Linux, and Windows applications on Windows. | None - manual attestation (documented review step) |
Ensure 'Microsoft FTP Service (FTPSVC)' is set to 'Disabled' or 'Not Installed'wt.windows.system-services.microsoft-ftp-service-ftpsvc | HIGH | Enables the server to be a File Transfer Protocol (FTP) server. Note: This service is not installed by default. It is supplied with Windows, but is installed by enabling an optional Windows feature (Internet Information Services - FTP Server). | Hosting an FTP server (especially a non-secure FTP server) from a workstation is an increased security risk, as the attack surface of that workstation is then greatly increased. Note: This security concern applies to any FTP server application installed on a workstation, not just IIS. | None - manual attestation (documented review step) |
Ensure 'Microsoft iSCSI Initiator Service (MSiSCSI)' is set to 'Disabled'wt.windows.system-services.microsoft-iscsi-initiator-service-msiscsi | MEDIUM | Manages Internet SCSI (iSCSI) sessions from this computer to remote target devices. | This service is critically necessary in order to directly attach to an iSCSI device. However, iSCSI itself uses a very weak authentication protocol (CHAP), which means that the passwords for iSCSI communication are easily exposed, unless all of the traffic is isolated and/or encrypted using another technology like IPsec. This service is generally more appropriate for servers in a controlled environment then on workstations requiring high security. | None - manual attestation (documented review step) |
Ensure 'OpenSSH SSH Server (sshd)' is set to 'Disabled' or 'Not Installed'wt.windows.system-services.openssh-ssh-server-sshd | HIGH | SSH protocol based service to provide secure encrypted communications between two untrusted hosts over an insecure network. Note: This service is not installed by default. It is supplied with Windows, but it is installed by enabling an optional Windows feature (OpenSSH Server). | Hosting an SSH server from a workstation is an increased security risk, as the attack surface of that workstation is then greatly increased. Note: This security concern applies to any SSH server application installed on a workstation, not just the one supplied with Windows. | None - manual attestation (documented review step) |
Ensure 'Password Age Days' is set to 'Configured: 30 or fewer'wt.windows.system-services.password-age-days | HIGH | This policy setting configures the Windows LAPS Password Settings policy for password age. Because attackers can crack passwords, the more frequently the password is changed the less opportunity an attacker has to use a cracked password. Note: Organizations that utilize third-party commercial software to manage unique & complex local Administrator passwords on domain members may opt to disregard these LAPS recommendations. Note #2: Windows LAPS does not support standalone computers - they must be joined to an Active Directory domain or Entra ID (formerly Azure Active Directory). | Due to the difficulty in managing local Administrator passwords, many organizations choose to use the same password on all workstations and/or Member Servers when deploying them. This creates a serious attack surface security risk because if an attacker manages to compromise one system and learn the password to its local Administrator account, then they can leverage that account to instantly gain access to all other computers that also use that password for their local Administrator account. | None - manual attestation (documented review step) |
Ensure 'Password Complexity' is set to 'Large letters + small letters + numbers + special characters'wt.windows.system-services.password-complexity | HIGH | This policy setting configures the Windows LAPS Password Settings policy for password complexity. Each additional character in a password increases its complexity exponentially. For instance, a seven-character, all lower-case alphabetic password would have 26 to the power of 7 (approximately 8 x 10 to the power of 9 or 8 billion) possible combinations. At 1,000,000 attempts per second (a capability of many password-cracking utilities), it would only take 133 minutes to crack. A seven-character alphabetic password with case sensitivity has 52 to the power of 7 combinations. A seven-character case-sensitive alphanumeric password without punctuation has 627 combinations. An eight-character password has 26 to the power of 8 (or 2 x 10 to the power of 11) possible combinations. Although this might seem to be a large number, at 1,000,000 attempts per second it would take only 59 hours to try all possible passwords. Remember, these times will significantly increase for passwords that use ALT characters and other special keyboard characters such as "!" or "@". Proper use of the password settings can help make it difficult to mount a brute force attack. Note: Organizations that utilize third-party commercial software to manage unique & complex local Administrator passwords on domain members may opt to disregard these LAPS recommendations. Note #2: Windows LAPS does not support standalone computers - they must be joined to an Active Directory domain or Entra ID (formerly Azure Active Directory). | Due to the difficulty in managing local Administrator passwords, many organizations choose to use the same password on all workstations and/or Member Servers when deploying them. This creates a serious attack surface security risk because if an attacker manages to compromise one system and learn the password to its local Administrator account, then they can leverage that account to instantly gain access to all other computers that also use that password for their local Administrator account. | None - manual attestation (documented review step) |
Ensure 'Password Length' is set to 'Configured: 15 or more'wt.windows.system-services.password-length | HIGH | This policy setting configures the Windows LAPS Password Settings policy for password length. Each additional character in a password increases its complexity exponentially. For instance, a seven-character, all lower-case alphabetic password would have 26 to the power of 7 (approximately 8 x 10 to the power of 9 or 8 billion) possible combinations. At 1,000,000 attempts per second (a capability of many password-cracking utilities), it would only take 133 minutes to crack. A seven-character alphabetic password with case sensitivity has 52 to the power of 7 combinations. A seven-character case-sensitive alphanumeric password without punctuation has 627 combinations. An eight-character password has 26 to the power of 8 (or 2 x 10 to the power of 11) possible combinations. Although this might seem to be a large number, at 1,000,000 attempts per second it would take only 59 hours to try all possible passwords. Remember, these times will significantly increase for passwords that use ALT characters and other special keyboard characters such as "!" or "@". Proper use of the password settings can help make it difficult to mount a brute force attack. Note: Organizations that utilize third-party commercial software to manage unique & complex local Administrator passwords on domain members may opt to disregard these LAPS recommendations. Note #2: Windows LAPS does not support standalone computers - they must be joined to an Active Directory domain or Entra ID (formerly Azure Active Directory). | Due to the difficulty in managing local Administrator passwords, many organizations choose to use the same password on all workstations and/or Member Servers when deploying them. This creates a serious attack surface security risk because if an attacker manages to compromise one system and learn the password to its local Administrator account, then they can leverage that account to instantly gain access to all other computers that also use that password for their local Administrator account. | None - manual attestation (documented review step) |
Ensure 'Post-authentication actions' is set to 'Reset the password and logoff the managed account' or higherwt.windows.system-services.post-authentication-actions | HIGH | This policy settings configures post-authentication actions which will be executed after detecting an authentication by the LAPS managed account. The Action refers to actions to take upon expiry of the grace period before executing the specified post- authentication actions. Post-authentication actions: • Reset password: upon expiry of the grace period, the managed account password will be reset. • Reset the password and logoff the managed account: upon expiry of the grace period, the managed account password will be reset and any interactive logon sessions using the managed account will terminated. • Reset the password and reboot the device: upon expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted. Warning: After an interactive logon session is terminated, other authenticated sessions using the Windows LAPS managed account may still be active. The only way to ensure that the previous password is no longer in use is to reboot the OS. Note: Organizations that utilize third-party commercial software to manage unique & complex local Administrator passwords on domain members may opt to disregard these LAPS recommendations. Note #2: Windows LAPS does not support standalone computers - they must be joined to an Active Directory domain or Entra ID (formerly Azure Active Directory). | Due to the difficulty in managing local Administrator passwords, many organizations choose to use the same password on all workstations and/or Member Servers when deploying them. This creates a serious attack surface security risk because if an attacker manages to compromise one system and learn the password to its local Administrator account, then they can leverage that account to instantly gain access to all other computers that also use that password for their local Administrator account. | None - manual attestation (documented review step) |
Ensure 'Post Authentication Reset Delay' is set to 'Configured: 8 or fewer hours, but not 0'wt.windows.system-services.post-authentication-reset-delay | HIGH | This policy settings configures post-authentication actions which will be executed after detecting an authentication by the Windows LAPS managed account. The Grace period refers to the amount of time (hours) to wait after an authentication before executing the specified post-authentication actions. Note: Organizations that utilize third-party commercial software to manage unique & complex local Administrator passwords on domain members may opt to disregard these LAPS recommendations. Note #2: Windows LAPS does not support standalone computers - they must be joined to an Active Directory domain or Entra ID (formerly Azure Active Directory). Note #3: If this policy is set to 0 it prevents all post-authentication actions from occurring. | Due to the difficulty in managing local Administrator passwords, many organizations choose to use the same password on all workstations and/or Member Servers when deploying them. This creates a serious attack surface security risk because if an attacker manages to compromise one system and learn the password to its local Administrator account, then they can leverage that account to instantly gain access to all other computers that also use that password for their local Administrator account. | None - manual attestation (documented review step) |
Ensure 'Print Spooler (Spooler)' is set to 'Disabled'wt.windows.system-services.print-spooler-spooler | MEDIUM | This service spools print jobs and handles interaction with printers. | In a high security environment, unnecessary services especially those with known vulnerabilities should be disabled. Disabling the Print Spooler (Spooler) service mitigates the PrintNightmare vulnerability (CVE-2021-34527) and other attacks against the service. | None - manual attestation (documented review step) |
Ensure 'Problem Reports and Solutions Control Panel Support (wercplsupport)' is set to 'Disabled'wt.windows.system-services.problem-reports-and-solutions-control-panel-support-wercplsupport | MEDIUM | This service provides support for viewing, sending and deletion of system-level problem reports for the Problem Reports and Solutions control panel. | This service is involved in the process of displaying/reporting issues & solutions to/from Microsoft. In a high security environment, preventing this information from being sent can help reduce privacy concerns for sensitive corporate information. | None - manual attestation (documented review step) |
Ensure 'Remote Access Auto Connection Manager (RasAuto)' is set to 'Disabled'wt.windows.system-services.remote-access-auto-connection-manager-rasauto | MEDIUM | Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. | The function of this service is to provide a "demand dial" type of functionality. In a high security environment, it is preferred that any remote "dial" connections (whether they be legacy dial-in POTS or VPN) are initiated by the user, not automatically by the system. | None - manual attestation (documented review step) |
Ensure 'Remote Desktop Configuration (SessionEnv)' is set to 'Disabled'wt.windows.system-services.remote-desktop-configuration-sessionenv | MEDIUM | Remote Desktop Configuration service (RDCS) is responsible for all Remote Desktop related configuration and session maintenance activities that require SYSTEM context. These include per-session temporary folders, RD themes, and RD certificates. | In a high security environment, Remote Desktop access is an increased security risk. For these environments, only local console access should be permitted. | None - manual attestation (documented review step) |
Ensure 'Remote Desktop Services (TermService)' is set to 'Disabled'wt.windows.system-services.remote-desktop-services-termservice | MEDIUM | Allows users to connect interactively to a remote computer. Remote Desktop and Remote Desktop Session Host Server depend on this service. | In a high security environment, Remote Desktop access is an increased security risk. For these environments, only local console access should be permitted. | None - manual attestation (documented review step) |
Ensure 'Remote Desktop Services UserMode Port Redirector (UmRdpService)' is set to 'Disabled'wt.windows.system-services.remote-desktop-services-usermode-port-redirector-umrdpservice | MEDIUM | Allows the redirection of Printers/Drives/Ports for RDP connections. | In a security-sensitive environment, it is desirable to reduce the possible attack surface - preventing the redirection of COM, LPT and PnP ports will reduce the number of unexpected avenues for data exfiltration and/or malicious code transfer within an RDP session. | None - manual attestation (documented review step) |
Ensure 'Remote Procedure Call (RPC) Locator (RpcLocator)' is set to 'Disabled'wt.windows.system-services.remote-procedure-call-rpc-locator-rpclocator | HIGH | In Windows 2003 and older versions of Windows, the Remote Procedure Call (RPC) Locator service manages the RPC name service database. In Windows Vista or newer versions of Windows, this service does not provide any functionality and is present for application compatibility. | This is a legacy service that has no value or purpose other than application compatibility for very old software. It should be disabled unless there is a specific old application still in use on the system that requires it. | None - manual attestation (documented review step) |
Ensure 'Remote Registry (RemoteRegistry)' is set to 'Disabled'wt.windows.system-services.remote-registry-remoteregistry | MEDIUM | Enables remote users to view and modify registry settings on this computer. | In a high security environment, exposing the registry to remote access is an increased security risk. | None - manual attestation (documented review step) |
Ensure 'Routing and Remote Access (RemoteAccess)' is set to 'Disabled'wt.windows.system-services.routing-and-remote-access-remoteaccess | HIGH | Offers routing services to businesses in local area and wide area network environments. | This service's main purpose is to provide Windows router functionality - this is not an appropriate use of workstations in an enterprise managed environment. | None - manual attestation (documented review step) |
Ensure 'Server (LanmanServer)' is set to 'Disabled'wt.windows.system-services.server-lanmanserver | MEDIUM | Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. | In a high security environment, a secure workstation should only be a client, not a server. Sharing workstation resources for remote access increases security risk as the attack surface is notably higher. | None - manual attestation (documented review step) |
Ensure 'Simple TCP/IP Services (simptcp)' is set to 'Disabled' or 'Not Installed'wt.windows.system-services.simple-tcp-ip-services-simptcp | HIGH | Supports the following TCP/IP services: Character Generator, Daytime, Discard, Echo, and Quote of the Day. Note: This service is not installed by default. It is supplied with Windows, but is installed by enabling an optional Windows feature (Simple TCPIP services (i.e. echo, daytime etc)). | The Simple TCP/IP Services have very little purpose in a modern enterprise environment - allowing them might increase exposure and risk for attack. | None - manual attestation (documented review step) |
Ensure 'SNMP Service (SNMP)' is set to 'Disabled' or 'Not Installed'wt.windows.system-services.snmp-service-snmp | MEDIUM | Enables Simple Network Management Protocol (SNMP) requests to be processed by this computer. Note: This service is not installed by default. It is supplied with Windows, but is installed by enabling an optional Windows feature (Simple Network Management Protocol (SNMP)). | Features that enable inbound network connections increase the attack surface. In a high security environment, management of secure workstations should be handled locally. | None - manual attestation (documented review step) |
Ensure 'Special Administration Console Helper (sacsvr)' is set to 'Disabled' or 'Not Installed'wt.windows.system-services.special-administration-console-helper-sacsvr | HIGH | This service allows administrators to remotely access a command prompt using Emergency Management Services. Note: This service is not installed by default. It is supplied with Windows, but it is installed by enabling an optional Windows capability (Windows Emergency Management Services and Serial Console). | Allowing the use of a remotely accessible command prompt that provides the ability to perform remote management tasks on a computer is a security risk. | None - manual attestation (documented review step) |
Ensure 'SSDP Discovery (SSDPSRV)' is set to 'Disabled'wt.windows.system-services.ssdp-discovery-ssdpsrv | HIGH | Discovers networked devices and services that use the SSDP discovery protocol, such as UPnP devices. Also announces SSDP devices and services running on the local computer. | Universal Plug n Play (UPnP) is a real security risk - it allows automatic discovery and attachment to network devices. Note that UPnP is different than regular Plug n Play (PnP). Workstations should not be advertising their services (or automatically discovering and connecting to networked services) in a security-conscious enterprise managed environment. | None - manual attestation (documented review step) |
Ensure 'UPnP Device Host (upnphost)' is set to 'Disabled'wt.windows.system-services.upnp-device-host-upnphost | HIGH | Allows UPnP devices to be hosted on this computer. | Universal Plug n Play (UPnP) is a real security risk - it allows automatic discovery and attachment to network devices. Notes that UPnP is different than regular Plug n Play (PnP). Workstations should not be advertising their services (or automatically discovering and connecting to networked services) in a security-conscious enterprise managed environment. | None - manual attestation (documented review step) |
Ensure 'Web Management Service (WMSvc)' is set to 'Disabled' or 'Not Installed'wt.windows.system-services.web-management-service-wmsvc | HIGH | The Web Management Service enables remote and delegated management capabilities for administrators to manage for the Web server, sites and applications present on the machine. Note: This service is not installed by default. It is supplied with Windows, but is installed by enabling an optional Windows feature (Internet Information Services - Web Management Tools - IIS Management Service). | Remote web administration of IIS on a workstation is an increased security risk, as the attack surface of that workstation is then greatly increased. If proper security mitigations are not followed, the chance of successful attack increases significantly. | None - manual attestation (documented review step) |
Ensure 'Windows Error Reporting Service (WerSvc)' is set to 'Disabled'wt.windows.system-services.windows-error-reporting-service-wersvc | MEDIUM | Allows errors to be reported when programs stop working or responding and allows existing solutions to be delivered. Also allows logs to be generated for diagnostic and repair services. | If a Windows Error occurs in a secure, enterprise managed environment, the error should be reported directly to IT staff for troubleshooting and remediation. There is no benefit to the corporation to report these errors directly to Microsoft, and there is some risk of unknowingly exposing sensitive data as part of the error. | None - manual attestation (documented review step) |
Ensure 'Windows Event Collector (Wecsvc)' is set to 'Disabled'wt.windows.system-services.windows-event-collector-wecsvc | MEDIUM | This service manages persistent subscriptions to events from remote sources that support WS-Management protocol. This includes Windows Vista event logs, hardware and IPMI-enabled event sources. The service stores forwarded events in a local Event Log. | In a high security environment, remote connections to secure workstations should be minimized, and management functions should be done locally. | None - manual attestation (documented review step) |
Ensure 'Windows Media Player Network Sharing Service (WMPNetworkSvc)' is set to 'Disabled' or 'Not Installed'wt.windows.system-services.windows-media-player-network-sharing-service-wmpnetworksvc | HIGH | Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play. | Network sharing of media from Media Player has no place in an enterprise managed environment. | None - manual attestation (documented review step) |
Ensure 'Windows Mobile Hotspot Service (icssvc)' is set to 'Disabled'wt.windows.system-services.windows-mobile-hotspot-service-icssvc | HIGH | Provides the ability to share a cellular data connection with another device. | The capability to run a mobile hotspot from a domain-connected computer could easily expose the internal network to wardrivers or other hackers. | None - manual attestation (documented review step) |
Ensure 'Windows Push Notifications System Service (WpnService)' is set to 'Disabled'wt.windows.system-services.windows-push-notifications-system-service-wpnservice | MEDIUM | This service runs in session 0 and hosts the notification platform and connection provider which handles the connection between the device and WNS server. Note: In the first two releases of Windows 10 (R1507 & R1511), the display name of this service was initially named Windows Push Notifications Service - but it was renamed to Windows Push Notifications System Service starting with Windows 10 R1607. | Windows Push Notification Services (WNS) is a mechanism to receive third-party notifications and updates from the cloud/Internet. In a high security environment, external systems, especially those hosted outside the organization, should be prevented from having an impact on the secure workstations. | None - manual attestation (documented review step) |
Ensure 'Windows PushToInstall Service (PushToInstall)' is set to 'Disabled'wt.windows.system-services.windows-pushtoinstall-service-pushtoinstall | MEDIUM | This service manages Apps that are pushed to the device from the Microsoft Store App running on other devices or the web. | In a high security managed environment, application installations should be managed centrally by IT staff, not by end users. | None - manual attestation (documented review step) |
Ensure 'Windows Remote Management (WS-Management) (WinRM)' is set to 'Disabled'wt.windows.system-services.windows-remote-management-ws-management-winrm | MEDIUM | Windows Remote Management (WinRM) service implements the WS-Management protocol for remote management. WS-Management is a standard web services protocol used for remote software and hardware management. The WinRM service listens on the network for WS-Management requests and processes them. | Features that enable inbound network connections increase the attack surface. In a high security environment, management of secure workstations should be handled locally. | None - manual attestation (documented review step) |
Ensure 'WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc)' is set to 'Disabled'wt.windows.system-services.winhttp-web-proxy-auto-discovery-service-winhttpautoproxysvc | MEDIUM | WinHTTP implements the client HTTP stack and provides developers with a Win32 API and COM Automation component for sending HTTP requests and receiving responses. In addition, WinHTTP provides support for auto-discovering a proxy configuration via its implementation of the Web Proxy Auto-Discovery (WPAD) protocol. Note: Although CIS categorizes this as a L2 recommendation, if none of the cases listed in the Impact Section apply, we highly recommend disabling this service. | This service is primarily needed to support Web Proxy Auto-Discovery (WPAD), which is an auto-proxy discovery mechanism that could expose the computer to Man-In-The- Middle (MITM) attacks. If an organization depends on HTTP proxy configuration, it is recommended that other client configuration mechanisms be used instead, such as Group Policy. | None - manual attestation (documented review step) |
Ensure 'World Wide Web Publishing Service (W3SVC)' is set to 'Disabled' or 'Not Installed'wt.windows.system-services.world-wide-web-publishing-service-w3svc | HIGH | Provides Web connectivity and administration through the Internet Information Services Manager. Note: This service is not installed by default. It is supplied with Windows, but is installed by enabling an optional Windows feature (Internet Information Services - World Wide Web Services). Note #2: An organization may choose to selectively grant exceptions to web developers to allow IIS (or another web server) on their workstation, in order for them to locally test & develop web pages. However, the organization should track those machines and ensure the security controls and mitigations are kept up to date, to reduce risk of compromise. | Hosting a website from a workstation is an increased security risk, as the attack surface of that workstation is then greatly increased. If proper security mitigations are not followed, the chance of successful attack increases significantly. Note: This security concern applies to any web server application installed on a workstation, not just IIS. | None - manual attestation (documented review step) |
Ensure 'Xbox Accessory Management Service (XboxGipSvc)' is set to 'Disabled'wt.windows.system-services.xbox-accessory-management-service | HIGH | This service manages connected Xbox Accessories. | Xbox Live is a gaming service and has no place in an enterprise managed environment (perhaps unless it is a gaming company). | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Xbox Live Auth Manager (XblAuthManager)' is set to 'Disabled'wt.windows.system-services.xbox-live-auth-manager | HIGH | Provides authentication and authorization services for interacting with Xbox Live. | Xbox Live is a gaming service and has no place in an enterprise managed environment (perhaps unless it is a gaming company). | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Xbox Live Game Save (XblGameSave)' is set to 'Disabled'wt.windows.system-services.xbox-live-game-save | HIGH | This service syncs save data for Xbox Live save enabled games. | Xbox Live is a gaming service and has no place in an enterprise managed environment (perhaps unless it is a gaming company). | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Xbox Live Networking Service (XboxNetApiSvc)' is set to 'Disabled'wt.windows.system-services.xbox-live-networking-service | HIGH | This service supports the Windows.Networking.XboxLive application programming interface. | Xbox Live is a gaming service and has no place in an enterprise managed environment (perhaps unless it is a gaming company). | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Font Providers' is set to 'Not allowed'wt.windows.system.allow-font-providers | MEDIUM | This policy setting determines whether Windows is allowed to download fonts and font catalog data from an online font provider. | In an enterprise managed environment the IT department should be managing the changes to the system configuration, to ensure all changes are tested and approved. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Location' is set to 'Force Location Off...'wt.windows.system.allow-location | MEDIUM | This policy setting turns off the location feature for the computer. All Location Privacy settings are toggled off and grayed out. Users can't change the settings, and no apps are allowed access to the Location service, including Cortana and Search.. | This setting affects the location feature (e.g. GPS or other location tracking). From a security perspective, it’s not a good idea to reveal your location to software in most cases, but there are legitimate uses, such as mapping software. However, they should not be used in high security environments. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Telemetry' is set to 'Basic' (Automated)wt.windows.system.allow-telemetry | HIGH | This policy setting determines the amount of diagnostic and usage data reported to Microsoft: Note: If your organization relies on Windows Update, the minimum recommended setting is Required diagnostic data. Because no Windows Update information is collected when diagnostic data is off, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of updates. Note #2: The Configure diagnostic data opt-in settings user interface group policy can be used to prevent end users from changing their data collection settings. Note #3: Enhanced diagnostic data setting is not available on Windows 11 and Windows Server 2022 and has been replaced with policies that can control the amount of optional diagnostic data that is sent. For more information on these settings visit Manage diagnostic data using Group Policy and MDM | Sending any data to a third-party vendor is a security concern and should only be done on an as needed basis. | None - manual attestation (documented review step) |
Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'wt.windows.system.control-event-log-behavior-when-the-log-file-reaches-its-maximum-size | HIGH | Controls what the System event log does once it reaches its configured maximum size. When disabled, the log overwrites the oldest events as needed instead of refusing new events. | The System log captures driver, service, and kernel-level events that are central to spotting persistence, suspicious driver loads, and forced reboots. Allowing roll-over keeps that stream flowing even when SIEM forwarding falls behind, rather than letting an attacker stall logging by filling the file. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Disable Enterprise Auth Proxy' is set to 'Enable'wt.windows.system.disable-enterprise-auth-proxy | MEDIUM | This policy setting controls whether the Connected User Experience and Telemetry service can automatically use an authenticated proxy to send data back to Microsoft. | Sending any data to a third-party vendor is a security concern and should only be done on an as needed basis. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Disable One Drive File Sync' is set to 'Sync Disabled'wt.windows.system.disable-one-drive-file-sync | MEDIUM | This policy setting lets you prevent apps and features from working with files on OneDrive using the Next Generation Sync Client. | Enabling this setting prevents users from accidentally (or intentionally) uploading confidential or sensitive corporate information to the OneDrive cloud service using the Next Generation Sync Client. Note: This security concern applies to any cloud-based file storage application installed on a workstation, not just the one supplied with Windows. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable OneSettings Auditing' is set to 'Enabled'wt.windows.system.enable-onesettings-auditing | HIGH | This policy setting controls whether Windows records attempts to connect with the OneSettings service to the Event Log. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Limit Diagnostic Log Collection' is set to 'Enabled'wt.windows.system.limit-diagnostic-log-collection | HIGH | This policy setting controls whether additional diagnostic logs are collected when more information is needed to troubleshoot a problem on the device. Note: Diagnostic logs are only sent when the device has been configured to send optional diagnostic data. Diagnostic data is limited when recommendation Allow Diagnostic Data is set to Enabled: Diagnostic data off (not recommended) or Enabled: Send required diagnostic data to send only basic information. | Sending data to a third-party vendor is a security concern and should only be done on an as-needed basis. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Limit Dump Collection' is set to 'Enabled'wt.windows.system.limit-dump-collection | HIGH | This policy setting limits the type of memory dumps that can be collected when more information is needed to troubleshoot a problem. Note: Memory dumps are only sent when the device has been configured to send optional diagnostic data. Diagnostic data is limited when recommendation Allow Diagnostic Data is set to Enabled: Diagnostic data off (not recommended) or Enabled: Send required diagnostic data to send only basic information. | Memory dumps can contain sensitive information. Sending this data to a third-party vendor is a security concern and should only be done on an as-needed basis. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater'wt.windows.system.specify-the-maximum-log-file-size-kb | HIGH | This policy setting specifies the maximum size of the log file in kilobytes. The maximum log file size can be configured between 1 megabyte (1,024 kilobytes) and 4 terabytes (4,194,240 kilobytes) in kilobyte increments. | If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users | None - manual attestation (documented review step) |
Ensure 'Do not delete temp folders upon exit' is set to 'Disabled'wt.windows.temporary-folders.do-not-delete-temp-folders-upon-exit | HIGH | This policy setting specifies whether Remote Desktop Services retains a user's per- session temporary folders at logoff. | Sensitive information could be contained inside the temporary folders and visible to other administrators that log into the system. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Windows NTP Client' is set to 'Enabled'wt.windows.time-providers.enable-windows-ntp-client | HIGH | This policy setting specifies whether the Windows NTP Client is enabled. Enabling the Windows NTP Client allows synchronization from a systems computer clock to NTP server(s). Note: If a third-party time provider is used in the environment, an exception to this recommendation will be needed. | A reliable and accurate account of time is important for a number of services and security requirements, including but not limited to distributed applications, authentication services, multi-user databases and logging services. The use of an NTP client (with secure operation) establishes functional accuracy and is a focal point when reviewing security relevant events. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable Windows NTP Server' is set to 'Disabled'wt.windows.time-providers.enable-windows-ntp-server | HIGH | This policy setting specifies whether the Windows NTP Server is enabled. Disabling this setting prevents the system from acting as a NTP Server (time source) to service NTP requests from other systems (NTP Clients). | The configuration of proper time synchronization is critically important in an enterprise managed environment both due to the sensitivity of Kerberos authentication timestamps and also to ensure accurate security logging. This should be done through a known NTP server. Member servers and workstations should not typically be time sources for other clients. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Access Credential Manager As Trusted Caller' is set to 'No One'wt.windows.user-rights.access-credential-manager-as-trusted-caller | HIGH | This security setting is used by Credential Manager during Backup and Restore. No accounts should have this user right, as it is only assigned to Winlogon. Users' saved credentials might be compromised if this user right is assigned to other entities. | If an account is given this right the user of the account may create an application that calls into Credential Manager and is returned the credentials for another user. | None - manual attestation (documented review step) |
Ensure 'Access From Network' is set to 'Administrators, Remote Desktop Users'wt.windows.user-rights.access-from-network | HIGH | This policy setting allows other users on the network to connect to the computer and is required by various network protocols that include Server Message Block (SMB)-based protocols, NetBIOS, Common Internet File System (CIFS), and Component Object Model Plus (COM+). Note: If your organization is using Microsoft Defender for Identity (formerly Azure Advanced Threat Protection (Azure ATP)), the (organization-named) Defender for Identity Directory Service Account (DSA), will also need to be granted the same Access from network User Right Assignment. For more information on adding the service account please see Make sure the DSA is allowed to access computers from the network in Microsoft Defender for Identity | Microsoft Docs. | Users who can connect from their computer to the network can access resources on target computers for which they have permission. For example, the Access this computer from the network user right is required for users to connect to shared printers and folders. If this user right is assigned to the Everyone group, then anyone will be able to read the files in those shared folders. However, this situation is unlikely for new installations of Windows Server 2003 with Service Pack 1 (SP1), because the default share and NTFS permissions in Windows Server 2003 do not include the Everyone group. This vulnerability may have a higher level of risk for computers that you upgrade from Windows NT 4.0 or Windows 2000, because the default permissions for these operating systems are not as restrictive as the default permissions in Windows Server 2003. | None - manual attestation (documented review step) |
Ensure 'Act As Part Of The Operating System' is set to 'No One'wt.windows.user-rights.act-as-part-of-the-operating-system | HIGH | This policy setting allows a process to assume the identity of any user and thus gain access to the resources that the user is authorized to access. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | The Act as part of the operating system user right is extremely powerful. Anyone with this user right can take complete control of the computer and erase evidence of their activities. | None - manual attestation (documented review step) |
Ensure 'Allow Local Log On' is set to 'Administrators, Users'wt.windows.user-rights.allow-local-log-on | HIGH | This policy setting determines which users can interactively log on to computers in your environment. Logons that are initiated by pressing the CTRL+ALT+DEL key sequence on the client computer keyboard require this user right. Users who attempt to log on through Terminal Services / Remote Desktop Services or IIS also require this user right. Note: The Guest account is also assigned this user right by default. Although this account is disabled by default, it's recommended that you configure this setting through Group Policy. However, this user right should generally be restricted to the Administrators and Users groups. Assign this user right to the Backup Operators group if your organization requires that they have this capability. | Any account with the Allow log on locally user right can log on at the console of the computer. If you do not restrict this user right to legitimate users who need to be able to log on to the console of the computer, unauthorized users could download and run malicious software to elevate their privileges. | None - manual attestation (documented review step) |
Ensure 'Backup Files And Directories' is set to 'Administrators'wt.windows.user-rights.backup-files-and-directories | HIGH | This policy setting allows users to circumvent file and directory permissions to back up the system. This user right is enabled only when an application (such as NTBACKUP) attempts to access a file or directory through the NTFS file system backup application programming interface (API). Otherwise, the assigned file and directory permissions apply. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | Users who are able to back up data from a computer could take the backup media to a non-domain computer on which they have administrative privileges and restore the data. They could take ownership of the files and view any unencrypted data that is contained within the backup set. | None - manual attestation (documented review step) |
Ensure 'Change System Time' is set to 'Administrators, LOCAL SERVICE'wt.windows.user-rights.change-system-time | HIGH | This policy setting determines which users and groups can change the time and date on the internal clock of the computers in your environment. Users who are assigned this user right can affect the appearance of event logs. When a computer's time setting is changed, logged events reflect the new time, not the actual time that the events occurred. Note: Discrepancies between the time on the local computer and on the Domain Controllers in your environment may cause problems for the Kerberos authentication protocol, which could make it impossible for users to log on to the domain or obtain authorization to access domain resources after they are logged on. Also, problems will occur when Group Policy is applied to client computers if the system time is not synchronized with the Domain Controllers. | Users who can change the time on a computer could cause several problems. For example, time stamps on event log entries could be made inaccurate, time stamps on files and folders that are created or modified could be incorrect, and computers that belong to a domain may not be able to authenticate themselves or users who try to log on to the domain from them. Also, because the Kerberos authentication protocol requires that the requestor and authenticator have their clocks synchronized within an administrator-defined skew period, an attacker who changes a computer's time may cause that computer to be unable to obtain or grant Kerberos tickets. The risk from these types of events is mitigated on most Domain Controllers, Member Servers, and end-user computers because the Windows Time service automatically synchronizes time with Domain Controllers in the following ways: • All client desktop computers and Member Servers use the authenticating Domain Controller as their inbound time partner. • All Domain Controllers in a domain nominate the Primary Domain Controller (PDC) Emulator operations master as their inbound time partner. • All PDC Emulator operations masters follow the hierarchy of domains in the selection of their inbound time partner. • The PDC Emulator operations master at the root of the domain is authoritative for the organization. Therefore it is recommended that you configure this computer to synchronize with a reliable external time server. This vulnerability becomes much more serious if an attacker is able to change the system time and then stop the Windows Time service or reconfigure it to synchronize with a time server that is not accurate. | None - manual attestation (documented review step) |
Ensure 'Create Global Objects' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE'wt.windows.user-rights.create-global-objects | HIGH | This policy setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions. This capability could lead to a variety of problems, such as application failure or data corruption. | Users who can create global objects could affect Windows services and processes that run under other user or system accounts. This capability could lead to a variety of problems, such as application failure, data corruption and elevation of privilege. | None - manual attestation (documented review step) |
Ensure 'Create Page File' is set to 'Administrators'wt.windows.user-rights.create-page-file | HIGH | This policy setting allows users to change the size of the pagefile. By making the pagefile extremely large or extremely small, an attacker could easily affect the performance of a compromised computer. | Users who can change the page file size could make it extremely small or move the file to a highly fragmented storage volume, which could cause reduced computer performance. | None - manual attestation (documented review step) |
Ensure 'Create Permanent Shared Objects' is set to 'No One'wt.windows.user-rights.create-permanent-shared-objects | HIGH | This user right is useful to kernel-mode components that extend the object namespace. However, components that run in kernel mode have this user right inherently. Therefore, it is typically not necessary to specifically assign this user right. | Users who have the Create permanent shared objects user right could create new shared objects and expose sensitive data to the network. | None - manual attestation (documented review step) |
Ensure 'Create Token' is set to 'No One' (Automated)wt.windows.user-rights.create-token | HIGH | This policy setting allows a process to create an access token, which may provide elevated rights to access sensitive data. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | A user account that is given this user right has complete control over the system and can lead to the system being compromised. It is highly recommended that you do not assign any user accounts this right. The operating system examines a user's access token to determine the level of the user's privileges. Access tokens are built when users log on to the local computer or connect to a remote computer over a network. When you revoke a privilege, the change is immediately recorded, but the change is not reflected in the user's access token until the next time the user logs on or connects. Users with the ability to create or modify tokens can change the level of access for any currently logged on account. They could escalate their own privileges or create a DoS condition. | None - manual attestation (documented review step) |
Ensure 'Debug Programs' is set to 'Administrators'wt.windows.user-rights.debug-programs | HIGH | This policy setting determines which user accounts will have the right to attach a debugger to any process or to the kernel, which provides complete access to sensitive and critical operating system components. Developers who are debugging their own applications do not need to be assigned this user right; however, developers who are debugging new system components will need it. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | The Debug programs user right can be exploited to capture sensitive computer information from system memory, or to access and modify kernel or application structures. Some attack tools exploit this user right to extract hashed passwords and other private security information, or to insert rootkit code. By default, the Debug programs user right is assigned only to administrators, which helps to mitigate the risk from this vulnerability. | None - manual attestation (documented review step) |
Ensure 'Deny Access From Network' to include 'Guests, Local account'wt.windows.user-rights.deny-access-from-network | HIGH | This policy setting prohibits users from connecting to a computer from across the network, which would allow users to access and potentially modify data remotely. In high security environments, there should be no need for remote users to access data on a computer. Instead, file sharing should be accomplished through the use of network servers. This user right supersedes the Access Computer From Network user right if an account is subject to both policies. Caution: Configuring a standalone (non-domain-joined) workstation as described above may result in an inability to remotely administer the workstation. Note: The security identifier Local account is not available in Windows 7 and Windows 8.0 unless MSKB 2871997 has been installed. | Users who can log on to the computer over the network can enumerate lists of account names, group names, and shared resources. Users with permission to access shared folders and files can connect over the network and possibly view or modify data. | None - manual attestation (documented review step) |
Ensure 'Deny Local Log On' to include 'Guests'wt.windows.user-rights.deny-local-log-on | HIGH | This security setting determines which users are prevented from logging on at the computer. This policy setting supersedes the Allow log on locally policy setting if an account is subject to both policies. Important: If you apply this security policy to the Everyone group, no one will be able to log on locally. Warning: The help text in Intune associated with this recommendation is for the setting, Deny log on as a service and not this setting. | Any account with the ability to log on locally could be used to log on at the console of the computer. If this user right is not restricted to legitimate users who need to log on to the console of the computer, unauthorized users might download and run malicious software that elevates their privileges. | None - manual attestation (documented review step) |
Ensure 'Deny Log On As Batch Job' to include 'Guests'wt.windows.user-rights.deny-log-on-as-batch-job | HIGH | This policy setting determines which accounts will not be able to log on to the computer as a batch job. A batch job is not a batch (.bat) file, but rather a batch-queue facility. Accounts that use the Task Scheduler to schedule jobs need this user right. This user right supersedes the Log on as a batch job user right, which could be used to allow accounts to schedule jobs that consume excessive system resources. Such an occurrence could cause a DoS condition. Failure to assign this user right to the recommended accounts can be a security risk. | Accounts that have the Log on as a batch job user right could be used to schedule jobs that could consume excessive computer resources and cause a DoS condition. | None - manual attestation (documented review step) |
Ensure 'Deny Log On As Service Job' to include 'Guests'wt.windows.user-rights.deny-log-on-as-service-job | HIGH | This security setting determines which service accounts are prevented from registering a process as a service. This user right supersedes the Log on as a service user right if an account is subject to both policies. Note: This security setting does not apply to the System, Local Service, or Network Service accounts. | Accounts that can log on as a service could be used to configure and start new unauthorized services, such as a keylogger or other malicious software. The benefit of the specified countermeasure is somewhat reduced by the fact that only users with administrative privileges can install and configure services, and an attacker who has already attained that level of access could configure the service to run with the System account. | None - manual attestation (documented review step) |
Ensure 'Deny Remote Desktop Services Log On' to include 'Guests, Local account'wt.windows.user-rights.deny-remote-desktop-services-log-on | HIGH | This policy setting determines whether users can log on as Remote Desktop clients. After the baseline workstation is joined to a domain environment, there is no need to use local accounts to access the workstation from the network. Domain accounts can access the workstation for administration and end-user processing. This user right supersedes the Allow log on through Remote Desktop Services user right if an account is subject to both policies. Caution: Configuring a standalone (non-domain-joined) workstation as described above may result in an inability to remotely administer the workstation. Caution #2: Configuring a cloud system workstation as described above may result in an inability log on to the workstation. In this case, Local Accounts need this ability for the log on to succeed. Note: The security identifier Local account is not available in Windows 7 and Windows 8.0 unless MSKB 2871997 has been installed. Note #2: In all versions of Windows prior to Windows 7, Remote Desktop Services was known as Terminal Services, so you should substitute the older term if comparing against an older OS. | Any account with the right to log on through Remote Desktop Services could be used to log on to the remote console of the computer. If this user right is not restricted to legitimate users who need to log on to the console of the computer, unauthorized users might download and run malicious software that elevates their privileges. | None - manual attestation (documented review step) |
Ensure 'Enable Delegation' is set to 'No One'wt.windows.user-rights.enable-delegation | HIGH | This policy setting allows users to change the Trusted for Delegation setting on a computer object in Active Directory. Abuse of this privilege could allow unauthorized users to impersonate other users on the network. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | Misuse of the Enable computer and user accounts to be trusted for delegation user right could allow unauthorized users to impersonate other users on the network. An attacker could exploit this privilege to gain access to network resources and make it difficult to determine what has happened after a security incident. | None - manual attestation (documented review step) |
Ensure 'Generate Security Audits' is set to 'LOCAL SERVICE, NETWORK SERVICE'wt.windows.user-rights.generate-security-audits | HIGH | This policy setting determines which users or processes can generate audit records in the Security log. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | An attacker could use this capability to create a large number of audited events, which would make it more difficult for a system administrator to locate any illicit activity. Also, if the event log is configured to overwrite events as needed, any evidence of unauthorized activities could be overwritten by a large number of unrelated events. | None - manual attestation (documented review step) |
Ensure 'Impersonate Client' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE'wt.windows.user-rights.impersonate-client | HIGH | The policy setting allows programs that run on behalf of a user to impersonate that user (or another specified account) so that they can act on behalf of the user. If this user right is required for this kind of impersonation, an unauthorized user will not be able to convince a client to connect-for example, by remote procedure call (RPC) or named pipes-to a service that they have created to impersonate that client, which could elevate the unauthorized user's permissions to administrative or system levels. Services that are started by the Service Control Manager have the built-in Service group added by default to their access tokens. COM servers that are started by the COM infrastructure and configured to run under a specific account also have the Service group added to their access tokens. As a result, these processes are assigned this user right when they are started. Also, a user can impersonate an access token if any of the following conditions exist: • The access token that is being impersonated is for this user. • The user, in this logon session, logged on to the network with explicit credentials to create the access token. • The requested level is less than Impersonate, such as Anonymous or Identify. An attacker with the Impersonate a client after authentication user right could create a service, trick a client to make them connect to the service, and then impersonate that client to elevate the attacker's level of access to that of the client. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | An attacker with the Impersonate a client after authentication user right could create a service, trick a client to make them connect to the service, and then impersonate that client to elevate the attacker's level of access to that of the client. | None - manual attestation (documented review step) |
Ensure 'Load Unload Device Drivers' is set to 'Administrators'wt.windows.user-rights.load-unload-device-drivers | HIGH | This policy setting allows users to dynamically load a new device driver on a system. An attacker could potentially use this capability to install malicious code that appears to be a device driver. This user right is required for users to add local printers or printer drivers in Windows Vista. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | Device drivers run as highly privileged code. A user who has the Load and unload device drivers user right could unintentionally install malicious code that masquerades as a device driver. Administrators should exercise greater care and install only drivers with verified digital signatures. | None - manual attestation (documented review step) |
Ensure 'Lock Memory' is set to 'No One' (Automated)wt.windows.user-rights.lock-memory | HIGH | This policy setting allows a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. If this user right is assigned, significant degradation of system performance can occur. | Users with the Lock pages in memory user right could assign physical memory to several processes, which could leave little or no RAM for other processes and result in a DoS condition. | None - manual attestation (documented review step) |
Ensure 'Log On As Batch Job' is set to 'Administrators'wt.windows.user-rights.log-on-as-batch-job | MEDIUM | This policy setting allows accounts to log on using the task scheduler service. Because the task scheduler is often used for administrative purposes, it may be needed in enterprise environments. However, its use should be restricted in high security environments to prevent misuse of system resources or to prevent attackers from using the right to launch malicious code after gaining user level access to a computer. | The Log on as a batch job user right presents a low-risk vulnerability. For most organizations, the default settings are sufficient. | None - manual attestation (documented review step) |
Ensure 'Manage auditing and security log' is set to 'Administrators'wt.windows.user-rights.manage-auditing-and-security-log | HIGH | This policy setting determines which users can change the auditing options for files and directories and clear the Security log. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | The ability to manage the Security event log is a powerful user right and it should be closely guarded. Anyone with this user right can clear the Security log to erase important evidence of unauthorized activity. | None - manual attestation (documented review step) |
Ensure 'Manage Volume' is set to 'Administrators'wt.windows.user-rights.manage-volume | HIGH | This policy setting allows users to manage the system's volume or disk configuration, which could allow a user to delete a volume and cause data loss as well as a denial-of- service condition. Note: A workstation with Microsoft SQL Server installed will require a special exception to this recommendation for the account that runs the SQL Server service to be granted this user right. | A user who is assigned the Perform volume maintenance tasks user right could delete a volume, which could result in the loss of data or a DoS condition. | None - manual attestation (documented review step) |
Ensure 'Modify Firmware Environment' is set to 'Administrators'wt.windows.user-rights.modify-firmware-environment | HIGH | This policy setting allows users to configure the system-wide environment variables that affect hardware configuration. This information is typically stored in the Last Known Good Configuration. Modification of these values and could lead to a hardware failure that would result in a denial of service condition. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | Anyone who is assigned the Modify firmware environment values user right could configure the settings of a hardware component to cause it to fail, which could lead to data corruption or a DoS condition. | None - manual attestation (documented review step) |
Ensure 'Modify Object Label' is set to 'No One'wt.windows.user-rights.modify-object-label | HIGH | This privilege determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege. | By modifying the integrity label of an object owned by another user a malicious user may cause them to execute code at a higher level of privilege than intended. | None - manual attestation (documented review step) |
Ensure 'Profile Single Process' is set to 'Administrators'wt.windows.user-rights.profile-single-process | HIGH | This policy setting determines which users can use tools to monitor the performance of non-system processes. Typically, you do not need to configure this user right to use the Microsoft Management Console (MMC) Performance snap-in. However, you do need this user right if System Monitor is configured to collect data using Windows Management Instrumentation (WMI). Restricting the Profile single process user right prevents intruders from gaining additional information that could be used to mount an attack on the system. | The Profile single process user right presents a moderate vulnerability. An attacker with this user right could monitor a computer's performance to help identify critical processes that they might wish to attack directly. The attacker may also be able to determine what processes run on the computer so that they could identify countermeasures that they may need to avoid, such as antivirus software, an intrusion- detection system, or which other users are logged on to a computer. | None - manual attestation (documented review step) |
Ensure 'Remote Shutdown' is set to 'Administrators'wt.windows.user-rights.remote-shutdown | HIGH | This policy setting allows users to shut down Windows Vista-based or newer computers from remote locations on the network. Anyone who has been assigned this user right can cause a denial of service (DoS) condition, which would make the computer unavailable to service user requests. Therefore, it is recommended that only highly trusted administrators be assigned this user right. | Any user who can shut down a computer could cause a DoS condition to occur. Therefore, this user right should be tightly restricted. | None - manual attestation (documented review step) |
Ensure 'Replace Process Level Token' is set to 'LOCAL SERVICE, NETWORK SERVICE'wt.windows.user-rights.replace-process-level-token | HIGH | This policy setting allows one process or service to start another service or process with a different security access token, which can be used to modify the security access token of that sub-process and result in the escalation of privileges. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | Users with the Replace a process level token privilege are able to start processes as other users whose credentials they know. They could use this method to hide their unauthorized actions on the computer. (On Windows 2000-based computers, use of the Replace a process level token user right also requires the user to have the Adjust memory quotas for a process user right that is discussed earlier in this section.) | None - manual attestation (documented review step) |
Ensure 'Restore Files And Directories' is set to 'Administrators'wt.windows.user-rights.restore-files-and-directories | HIGH | This policy setting determines which users can bypass file, directory, registry, and other persistent object permissions when restoring backed up files and directories on computers that run Windows Vista (or newer) in your environment. This user right also determines which users can set valid security principals as object owners; it is similar to the Back up files and directories user right. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | An attacker with the Restore files and directories user right could restore sensitive data to a computer and overwrite data that is more recent, which could lead to loss of important data, data corruption, or a denial of service. Attackers could overwrite executable files that are used by legitimate administrators or system services with versions that include malicious software to grant themselves elevated privileges, compromise data, or install backdoors for continued access to the computer. Note: Even if the following countermeasure is configured, an attacker could still restore data to a computer in a domain that is controlled by the attacker. Therefore, it is critical that organizations carefully protect the media that is used to back up data. | None - manual attestation (documented review step) |
Ensure 'Shut Down The System' is set to 'Administrators, Users'wt.windows.user-rights.shut-down-the-system | HIGH | This policy setting determines which users who are logged on locally to the computers in your environment can shut down the operating system with the Shut Down command. Misuse of this user right can result in a denial of service condition. | The ability to shut down a workstation should be available generally to Administrators and authorized users of that workstation, but not permitted for guests or unauthorized users - in order to prevent a Denial of Service attack. | None - manual attestation (documented review step) |
Ensure 'Take Ownership' is set to 'Administrators'wt.windows.user-rights.take-ownership | HIGH | This policy setting allows users to take ownership of files, folders, registry keys, processes, or threads. This user right bypasses any permissions that are in place to protect objects to give ownership to the specified user. Note: This user right is considered a "sensitive privilege" for the purposes of auditing. | Any users with the Take ownership of files or other objects user right can take control of any object, regardless of the permissions on that object, and then make any changes they wish to that object. Such changes could result in exposure of data, corruption of data, or a DoS condition. | None - manual attestation (documented review step) |
Ensure 'Create Symbolic Links' is set to 'Administrators'wt.windows.virtual-machines-user-rights.create-symbolic-links | HIGH | This policy setting determines which users can create symbolic links. In Windows Vista, existing NTFS file system objects, such as files and folders, can be accessed by referring to a new kind of file system object called a symbolic link. A symbolic link is a pointer (much like a shortcut or .lnk file) to another file system object, which can be a file, folder, shortcut or another symbolic link. The difference between a shortcut and a symbolic link is that a shortcut only works from within the Windows shell. To other programs and applications, shortcuts are just another file, whereas with symbolic links, the concept of a shortcut is implemented as a feature of the NTFS file system. Symbolic links can potentially expose security vulnerabilities in applications that are not designed to use them. For this reason, the privilege for creating symbolic links should only be assigned to trusted users. By default, only Administrators can create symbolic links. | Users who have the Create symbolic links user right could inadvertently or maliciously expose your system to symbolic link attacks. Symbolic link attacks can be used to change the permissions on a file, to corrupt data, to destroy data, or as a Denial of Service attack. | None - manual attestation (documented review step) |
Ensure 'Hypervisor Enforced Code Integrity' is set to 'Enabled with UEFI lock'wt.windows.virtualization-based-technology.hypervisor-enforced-code-integrity | HIGH | This setting enables virtualization based protection of Kernel Mode Code Integrity. When this is enabled, kernel mode memory protections are enforced and the Code Integrity validation path is protected by the Virtualization Based Security feature. Note: Virtualization Based Security requires a 64-bit version of Windows with Secure Boot enabled, which in turn requires that Windows was installed with a UEFI BIOS configuration, not a Legacy BIOS configuration. In addition, if running Windows on a virtual machine, the hardware-assisted CPU virtualization feature (Intel VT-x or AMD-V) must be exposed by the host to the guest VM. More information on system requirements for this feature can be found at Windows Defender Credential Guard Requirements (Windows 10) | Microsoft Docs Note #2: Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs. | The Enabled with UEFI lock option ensures that Virtualization Based Protection of Code Integrity cannot be disabled remotely. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require UEFI Memory Attributes Table' is set to 'Require UEFI Memory Attributes Table'wt.windows.virtualization-based-technology.require-uefi-memory-attributes-table | HIGH | This option will only enable Virtualization Based Protection of Code Integrity on devices with UEFI firmware support for the Memory Attributes Table. Devices without the UEFI Memory Attributes Table may have firmware that is incompatible with Virtualization Based Protection of Code Integrity which in some cases can lead to crashes or data loss or incompatibility with certain plug-in cards. If not setting this option the targeted devices should be tested to ensure compatibility. Note: Virtualization Based Security requires a 64-bit version of Windows with Secure Boot enabled, which in turn requires that Windows was installed with a UEFI BIOS configuration, not a Legacy BIOS configuration. In addition, if running Windows on a virtual machine, the hardware-assisted CPU virtualization feature (Intel VT-x or AMD-V) must be exposed by the host to the guest VM. More information on system requirements for this feature can be found at Windows Defender Credential Guard Requirements (Windows 10) | Microsoft Docs Note #2: Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs. | This setting will help protect this control from being enabled on a system that is not compatible which could lead to a crash or data loss. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Profile System Performance' is set to 'Administrators, NT SERVICE\WdiServiceHost'wt.windows.wdiservicehost-user-rights.profile-system-performance | HIGH | This policy setting allows users to use tools to view the performance of different system processes, which could be abused to allow attackers to determine a system's active processes and provide insight into the potential attack surface of the computer. | The Profile system performance user right poses a moderate vulnerability. Attackers with this user right could monitor a computer's performance to help identify critical processes that they might wish to attack directly. Attackers may also be able to determine what processes are active on the computer so that they could identify countermeasures that they may need to avoid, such as antivirus software or an intrusion detection system. | None - manual attestation (documented review step) |
Ensure 'Allow Auto Connect To Wi Fi Sense Hotspots' is set to 'Block'wt.windows.wi-fi-settings.allow-auto-connect-to-wi-fi-sense-hotspots | HIGH | This policy setting determines whether users can enable the following WLAN settings: "Connect to suggested open hotspots," "Connect to networks shared by my contacts," and "Enable paid services". • "Connect to suggested open hotspots" enables Windows to automatically connect users to open hotspots it knows about by crowdsourcing networks that other people using Windows have connected to. • "Connect to networks shared by my contacts" enables Windows to automatically connect to networks that the user's contacts have shared with them, and enables users on this device to share networks with their contacts. • "Enable paid services" enables Windows to temporarily connect to open hotspots to determine if paid services are available. Note: These features are also known by the name "Wi-Fi Sense". | Automatically connecting to an open hotspot or network can introduce the system to a rogue network with malicious intent. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow widgets' is set to 'Not allowed'wt.windows.widgets.allow-widgets | HIGH | This policy setting specifies whether the Widgets feature is allowed on the device. The Widgets feature provides information such as, weather, news, sports, stocks, traffic, and entertainment (not an inclusive list). | Due to privacy concerns, apps and features such as Widgets on the Windows taskbar should be treated as a possible security risk due to the potential of data being sent back to third-parties, such as Microsoft. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Increase Scheduling Priority' is set to 'Administrators, Window Manager\Window Manager Group'wt.windows.window-manager-group-user-rights.increase-scheduling-priority | HIGH | This policy setting determines whether users can increase the base priority class of a process. (It is not a privileged operation to increase relative priority within a priority class.) This user right is not required by administrative tools that are supplied with the operating system but might be required by software development tools. | A user who is assigned this user right could increase the scheduling priority of a process to Real-Time, which would leave little processing time for all other processes and could lead to a DoS condition. | None - manual attestation (documented review step) |
Ensure 'Configuration of wireless settings using Windows Connect Now' is set to 'Disabled'wt.windows.windows-connect-now.configuration-of-wireless-settings-using-windows-connect-now | MEDIUM | This policy setting allows the configuration of wireless settings using Windows Connect Now (WCN). The WCN Registrar enables the discovery and configuration of devices over Ethernet (UPnP) over in-band 802.11 Wi-Fi through the Windows Portable Device API (WPD) and via USB Flash drives. Additional options are available to allow discovery and configuration over a specific medium. | This setting enhances the security of the environment and reduces the overall risk exposure related to user configuration of wireless settings. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Prohibit access of the Windows Connect Now wizards' is set to 'Enabled'wt.windows.windows-connect-now.prohibit-access-of-the-windows-connect-now-wizards | MEDIUM | This policy setting prohibits access to Windows Connect Now (WCN) wizards. | Allowing standard users to access the Windows Connect Now wizard increases the risk and attack surface. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is set to 'Enabled: 3 = Prevent Wi-Fi when on Ethernet'wt.windows.windows-connection-manager.minimize-the-number-of-simultaneous-connections-to-the-internet-or-a-windows-domain | HIGH | This policy setting prevents computers from establishing multiple simultaneous connections to either the Internet or to a Windows domain. | Preventing bridged network connections can help prevent a user unknowingly allowing traffic to route between internal and external networks, which risks exposure to sensitive internal data. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Prohibit connection to non-domain networks when connected to domain authenticated network' is set to 'Enabled'wt.windows.windows-connection-manager.prohibit-connection-to-non-domain-networks-when-connected-to-domain-authenticated-network | HIGH | This policy setting prevents computers from connecting to both a domain based network and a non-domain based network at the same time. | The potential concern is that a user would unknowingly allow network traffic to flow between the insecure public network and the enterprise managed network. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Disallow Exploit Protection Override' is set to '(Enable)'wt.windows.windows-defender-security-center.disallow-exploit-protection-override | HIGH | This policy setting prevent users from making changes to the Exploit protection settings area in the Windows Security settings. | Only authorized IT staff should be able to make changes to the exploit protection settings in order to ensure the organizations specific configuration is not modified. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable ESS with Supported Peripherals' is set to 'Enhanced sign-in security will be enabled…'wt.windows.windows-hello-for-business.enable-ess-with-supported-peripherals | HIGH | Enhanced Sign-in Security isolates Windows Hello biometric (face and fingerprint) template data and matching operations to trusted hardware or specified memory regions. Authentication operations of any peripheral biometric device will be blocked and not available for Windows Hello. (default and recommended for highest security).. | Because the channel of communication between the sensors and the algorithm is secured, it is impossible for malware to inject or replay data in order to simulate a user signing in or to lock a user out of their machine. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Facial Features Use Enhanced Anti Spoofing' is set to 'true'wt.windows.windows-hello-for-business.facial-features-use-enhanced-anti-spoofing | HIGH | This policy setting determines whether enhanced anti-spoofing is configured for devices which support it. | Enterprise managed environments are now supporting a wider range of mobile devices, increasing the security on these devices will help protect against unauthorized access on your network. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Minimum PIN Length' is set to '6 more character(s)'wt.windows.windows-hello-for-business.minimum-pin-length | HIGH | Minimum PIN length configures the minimum number of characters required for the PIN. The lowest number you can configure for this policy setting is 4. The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127, whichever is the lowest. | Windows Hello for Business utilizes key-based or certificate-based authentication and makes credential theft extremely difficult. When backed with a TPM chip multiple physical security mechanisms are added in order to make it tamper resistant. | None - manual attestation (documented review step) |
Ensure 'Require Security Device' is set to 'true'wt.windows.windows-hello-for-business.require-security-device | HIGH | This policy controls whether a Trusted Platform Module (TPM) is required to provision Windows Hello for Business. • If you enable this policy setting, only devices with a usable TPM provision Windows Hello for Business. • If you disable or don't configure this policy setting, the TPM is still preferred, but all devices provision Windows Hello for Business using software if the TPM is non-functional or unavailable. | Windows Hello for Business utilizes key-based or certificate-based authentication and makes credential theft extremely difficult. When backed with a TPM chip multiple physical security mechanisms are added in order to make it tamper resistant. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow suggested apps in Windows Ink Workspace' is set to 'Block'wt.windows.windows-ink-workspace.allow-suggested-apps-in-windows-ink-workspace | MEDIUM | This policy setting determines whether suggested apps in Windows Ink Workspace are allowed. | This Microsoft feature is designed to collect data and suggest apps based on that data collected. Disabling this setting will help ensure your data is not shared with any third party. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Windows Ink Workspace' is set to 'Enabled: but the user can't access it above the lock screen' OR 'Disabled'wt.windows.windows-ink-workspace.allow-windows-ink-workspace | HIGH | This policy setting determines whether Windows Ink items are allowed above the lock screen. The feature is turned off. | Allowing any apps to be accessed while system is locked is not recommended. If this feature is permitted, it should only be accessible once a user authenticates with the proper credentials. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Prevent Internet Explorer security prompt for Windows Installer scripts' is set to 'Disabled'wt.windows.windows-installer.prevent-internet-explorer-security-prompt-for-windows-installer-scripts | MEDIUM | This policy setting controls whether Web-based programs are allowed to install software on the computer without notifying the user. | Suppressing the system warning can pose a security risk and increase the attack surface on the system. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Enable MPR notifications for the system' is set to 'Disabled'wt.windows.windows-logon-options.enable-mpr-notifications-for-the-system | HIGH | This policy setting controls whether winlogon sends Multiple Provider Router (MPR) notifications. MPR handles communication between the Windows operating system and the installed network providers. MPR checks the registry to determine which providers are installed on the system and the order they are cycled through. | MPR is a legacy utility that provides notifications to registered credential managers or network providers when there is a logon event or a password change event. Although this functionality can be used by legitimate applications, it can also be abused by attackers to harvest logon information. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Sign-in and lock last interactive user automatically after a restart' is set to 'Disabled'wt.windows.windows-logon-options.sign-in-and-lock-last-interactive-user-automatically-after-a-restart | HIGH | This policy setting controls whether a device will automatically sign-in the last interactive user after Windows Update restarts the system. | Disabling this feature will prevent the caching of user's credentials and unauthorized use of the device, and also ensure the user is aware of the restart. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn on PowerShell Script Block Logging' is set to 'Enabled'wt.windows.windows-powershell.turn-on-powershell-script-block-logging | MEDIUM | This policy setting enables logging of all PowerShell script input to the Applications and Services Logs\Microsoft\Windows\PowerShell\Operational Event Log channel. Note: If logging of Script Block Invocation Start/Stop Events is enabled (option box checked), PowerShell will log additional events when invocation of a command, script block, function, or script starts or stops. Enabling this option generates a high volume of event logs. CIS has intentionally chosen not to make a recommendation for this option, since it generates a large volume of events. If an organization chooses to enable the optional setting (checked), this also conforms to the benchmark. | Logs of PowerShell script input can be very valuable when performing forensic investigations of PowerShell attack incidents to determine what occurred. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Turn on PowerShell Transcription' is set to 'Enabled'wt.windows.windows-powershell.turn-on-powershell-transcription | MEDIUM | This Policy setting lets you capture the input and output of Windows PowerShell commands into text-based transcripts. | PowerShell transcript input can be very valuable when performing forensic investigations of PowerShell attack incidents to determine what occurred. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Remote Shell Access' is set to 'Disabled'wt.windows.windows-remote-shell.allow-remote-shell-access | MEDIUM | This policy setting allows you to manage configuration of remote access to all supported shells to execute scripts and commands. Note: The GPME help text for this setting is incorrectly worded, implying that configuring it to Enabled will reject new Remote Shell connections, and setting it to Disabled will allow Remote Shell connections. The opposite is true (and is consistent with the title of the setting). This is a wording mistake by Microsoft in the Administrative Template. | Any feature is a potential avenue of attack, those that enable inbound network connections are particularly risky. Only enable the use of the Windows Remote Shell on trusted networks and when feasible employ additional controls such as IPsec. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Clipboard Redirection' is set to 'Not allowed'wt.windows.windows-sandbox.allow-clipboard-redirection | HIGH | This policy setting enables or disables clipboard sharing with the Windows Sandbox. Note: The Windows Sandbox feature was first introduced in Windows 10 R1903, and allows a temporary "clean install" virtual instance of Windows to be run inside the host, for the ostensible purpose of testing applications without making changes to the host. | Disabling copy and paste decreases the attack surface exposed by the Windows Sandbox and possible exposure of untrusted applications to the internal network. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Networking' is set to 'Not allowed'wt.windows.windows-sandbox.allow-networking | HIGH | This policy setting enables or disables networking in the Windows Sandbox. Networking is achieved by creating a virtual switch on the host, and connecting the Windows Sandbox to it via a virtual Network Interface Card (NIC). Note: The Windows Sandbox feature was first introduced in Windows 10 R1903, and allows a temporary "clean install" virtual instance of Windows to be run inside the host, for the ostensible purpose of testing applications without making changes to the host. | Disabling network access decreases the attack surface exposed by the Windows Sandbox and exposure of untrusted applications to the internal network. Note: Per Microsoft, enabling networking in the Windows Sandbox can expose untrusted applications to the internal network. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Auto Update' is set to 'Enabled'wt.windows.windows-update-for-business.allow-auto-update | HIGH | This policy setting specifies whether computers in your environment will receive security updates from Windows Update or WSUS. If you configure this policy setting to Enabled, the operating system will recognize when a network connection is available and then use the network connection to search Windows Update or your designated intranet site for updates that apply to them. After this this policy setting is set to Enabled, select one of the following options in the Configure Automatic Updates Properties dialog box to specify how the service will work: • 2 - Auto install and restart. • 3 - Auto install and restart at a specified time. (Default) • 4 - Auto install and restart without end-user control. The only scored requirement is to not turn off automatic updates (5). Note #2: Organizations that utilize a third--party solution for patching may choose to exempt themselves from this recommendation, and instead configure it to Disabled so that the native Windows Update mechanism does not interfere with the third--party patching process. Warning: If option 3 or 4 is not selected, then the ScheduledInstallDay recommendation will not take effect and an exception to that recommendation will be needed. | Although each version of Windows is thoroughly tested before release, it is possible that problems will be discovered after the products are shipped. The Configure Automatic Updates setting can help you ensure that the computers in your environment will always have the most recent critical operating system updates and service packs installed. | None - manual attestation (documented review step) |
Ensure 'Block "Pause Updates" ability' is set to 'Block'wt.windows.windows-update-for-business.block-pause-updates-ability | HIGH | This policy removes access to "Pause updates" feature. | In order to ensure security and system updates are applied, system administrators should control when updates are applied to systems. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Defer Feature Updates Period in Days' is set to 'Enabled: 180 or more days'wt.windows.windows-update-for-business.defer-feature-updates-period-in-days | HIGH | This policy setting determines when Preview Build or Feature Updates are received. Defer Updates This enables devices to defer taking the next Feature Update available to your channel for up to 14 days for all the pre-release channels and up to 365 days for the Semi-Annual Channel. Or, if the device is updating from the Semi-Annual Channel, a version for the device to move to and/or stay on until the policy is updated or the device reaches end of service can be specified. Note: If you set both policies, the version specified will take precedence and the deferrals will not be in effect. Please see the Windows Release Information page for OS version information. Pause Updates To prevent Feature Updates from being received on their scheduled time, you can temporarily pause Feature Updates. The pause will remain in effect for 35 days from the specified start date or until the field is cleared (Quality Updates will still be offered). Note: If the "Allow Diagnostic Data" (formerly "Allow Telemetry") policy is set to 0, this policy will have no effect. Note #2: Starting with Windows 10 R1607, Microsoft introduced a new Windows Update (WU) client behavior called Dual Scan, with an eye to cloud-based update management. In some cases, this Dual Scan feature can interfere with Windows Updates from Windows Server Update Services (WSUS) and/or manual WU updates. If you are using WSUS in your environment, you may need to set the above setting to Not Configured or configure the setting Do not allow update deferral policies to cause scans against Windows Update (added in the Windows 10 Release 1709 Administrative Templates) in order to prevent the Dual Scan feature from interfering. More information on Dual Scan is available at these links: • Demystifying “Dual Scan” - WSUS Product Team Blog • Improving Dual Scan on 1607 - WSUS Product Team Blog Note #3: Prior to Windows 10 R1703, values above 180 days are not recognized by the OS. Starting with Windows 10 R1703, the maximum number of days you can defer is 365 days. | In a production environment, it is preferred to only use software and features that are publicly available, after they have gone through rigorous testing in beta. | None - manual attestation (documented review step) |
Ensure 'Defer Quality Updates Period (Days)' is set to 'Enabled: 0 days'wt.windows.windows-update-for-business.defer-quality-updates-period-days | HIGH | This policy settings controls when Quality Updates are received. Note: If the "Allow Telemetry" policy is set to 0, this policy will have no effect. Note #2: Starting with Windows 10 R1607, Microsoft introduced a new Windows Update (WU) client behavior called Dual Scan, with an eye to cloud-based update management. In some cases, this Dual Scan feature can interfere with Windows Updates from Windows Server Update Services (WSUS) and/or manual WU updates. If you are using WSUS in your environment, you may need to set the above setting to Not Configured or configure the setting Do not allow update deferral policies to cause scans against Windows Update (added in the Windows 10 Release 1709 Administrative Templates) in order to prevent the Dual Scan feature from interfering. More information on Dual Scan is available at these links: • Demystifying “Dual Scan” - WSUS Product Team Blog • Improving Dual Scan on 1607 - WSUS Product Team Blog | Quality Updates can contain important bug fixes and/or security patches, and should be installed as soon as possible. | None - manual attestation (documented review step) |
Ensure 'Manage preview builds' is set to 'Disable Preview builds'wt.windows.windows-update-for-business.manage-preview-builds | HIGH | This policy setting manages which updates that are received prior to the update being released. Dev Channel: Ideal for highly technical users. Insiders in the Dev Channel will receive builds from our active development branch that is earliest in a development cycle. These builds are not matched to a specific Windows 10 release. Beta Channel: Ideal for feature explorers who want to see upcoming Windows 10 features. Your feedback will be especially important here as it will help our engineers ensure key issues are fixed before a major release. Release Preview Channel (default): Insiders in the Release Preview Channel will have access to the upcoming release of Windows 10 prior to it being released to the world. These builds are supported by Microsoft. The Release Preview Channel is where we recommend companies preview and validate upcoming Windows 10 releases before broad deployment within their organization. Note: Preview Build enrollment requires a telemetry level setting of 2 or higher and your domain registered on insider.windows.com. For additional information on Preview Builds, see: Managing preview builds across your organization - Windows Insider Program | Microsoft Learn. | It can be risky for experimental features to be allowed in an enterprise managed environment because this can introduce bugs and security holes into systems, making it easier for an attacker to gain access. It is generally preferred to only use production- ready builds. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Scheduled Install Day' is set to 'Every day'wt.windows.windows-update-for-business.scheduled-install-day | HIGH | This policy setting specifies when computers in your environment will receive security updates from Windows Update or WSUS. Note: This setting is only applicable if the option of 3 or 4 is selected in the recommendation 'Allow Auto Update'. It will have no impact if any other option is selected. | Although each version of Windows is thoroughly tested before release, it is possible that problems will be discovered after the products are shipped. The Configure Automatic Updates setting can help you ensure that the computers in your environment will always have the most recent critical operating system updates and service packs installed. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Basic authentication' is set to 'Disabled'wt.windows.winrm-client.allow-basic-authentication | HIGH | This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication. Note: Clients that use Microsoft's Exchange Online service (Office 365) will require an exception to this recommendation, to instead have this setting set to Enabled. Exchange Online uses Basic authentication over HTTPS, and so the Exchange Online authentication traffic will still be safely encrypted. | Basic authentication is less robust than other authentication methods available in WinRM because credentials including passwords are transmitted in plain text. An attacker who is able to capture packets on the network where WinRM is running may be able to determine the credentials used for accessing remote hosts via WinRM. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow unencrypted traffic' is set to 'Disabled'wt.windows.winrm-client.allow-unencrypted-traffic | HIGH | This policy setting allows you to manage whether the Windows Remote Management (WinRM) client sends and receives unencrypted messages over the network. | Encrypting WinRM network traffic reduces the risk of an attacker viewing or modifying WinRM messages as they transit the network. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Disallow Digest authentication' is set to 'Enabled'wt.windows.winrm-client.disallow-digest-authentication | HIGH | This policy setting allows you to manage whether the Windows Remote Management (WinRM) client will not use Digest authentication. | Digest authentication is less robust than other authentication methods available in WinRM, an attacker who is able to capture packets on the network where WinRM is running may be able to determine the credentials used for accessing remote hosts via WinRM. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow Basic authentication' is set to 'Disabled'wt.windows.winrm-service.allow-basic-authentication | HIGH | This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Basic authentication from a remote client. | Basic authentication is less robust than other authentication methods available in WinRM because credentials including passwords are transmitted in plain text. An attacker who is able to capture packets on the network where WinRM is running may be able to determine the credentials used for accessing remote hosts via WinRM. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow remote server management through WinRM' is set to 'Disabled'wt.windows.winrm-service.allow-remote-server-management-through-winrm | MEDIUM | This policy setting allows you to manage whether the Windows Remote Management (WinRM) service automatically listens on the network for requests on the HTTP transport over the default HTTP port. | Any feature is a potential avenue of attack, those that enable inbound network connections are particularly risky. Only enable the use of the Windows Remote Management (WinRM) service on trusted networks and when feasible employ additional controls such as IPsec. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Allow unencrypted traffic' is set to 'Disabled'wt.windows.winrm-service.allow-unencrypted-traffic | HIGH | This policy setting allows you to manage whether the Windows Remote Management (WinRM) service sends and receives unencrypted messages over the network. | Encrypting WinRM network traffic reduces the risk of an attacker viewing or modifying WinRM messages as they transit the network. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Disallow WinRM from storing RunAs credentials' is set to 'Enabled'wt.windows.winrm-service.disallow-winrm-from-storing-runas-credentials | HIGH | This policy setting allows you to manage whether the Windows Remote Management (WinRM) service will allow RunAs credentials to be stored for any plug-ins. Note: If you enable and then disable this policy setting, any values that were previously configured for RunAsPassword will need to be reset. | Although the ability to store RunAs credentials is a convenient feature it increases the risk of account compromise slightly. For example, if you forget to lock your desktop before leaving it unattended for a few minutes another person could access not only the desktop of your computer but also any hosts you manage via WinRM with cached RunAs credentials. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |
Ensure 'Require PIN For Pairing' is set to 'Enabled: Pairing ceremony for new devices will always require a PIN' OR 'All pairings will require PIN'wt.windows.wireless-display.require-pin-pairing | HIGH | This policy setting controls whether or not a PIN is required for pairing to a wireless display device. | If this setting is not configured or disabled then a PIN would not be required when pairing wireless display devices to the system, increasing the risk of unauthorized use. | DeviceManagementConfiguration.Read.All - via windowsConfigurationProfiles |