National Institute of Standards and Technology 5.4 2009-04-08T14:58:35.000-05:00 Microsoft Windows Vista Account Lockout Duration Microsoft Windows Vista Account Lockout Duration Microsoft Windows Vista Reset Account Lockout Counter After Microsoft Windows Vista The number of passwords remembered Microsoft Windows Vista todo Microsoft Windows Vista todo Microsoft Windows Vista Minimum Password Length Microsoft Windows Vista Password Complexity Microsoft Windows Vista Reversible Password Encryption Microsoft Windows Vista Audit account logon events Microsoft Windows Vista Audit account management Microsoft Windows Vista Audit account management Microsoft Windows Vista Audit logon events Microsoft Windows Vista Audit object access Microsoft Windows Vista Audit policy changes Microsoft Windows Vista Audit privilege use Microsoft Windows Vista Audit process tracking Microsoft Windows Vista Audit system events Microsoft Windows Vista This definition verifies that the Administrator account is enabled/disabled based on the policy defined by the user. Microsoft Windows Vista Accounts: Guest account status Microsoft Windows Vista Accounts: Limit local account use to blank passwords to console logon only Microsoft Windows Vista Accounts: Rename Administrator Account Microsoft Windows Vista Accounts: Rename Guest Account Microsoft Windows Vista Audit the access of global system objects is disabled Microsoft Windows Vista Audit: Audit the use of Backup and Restore privilege Microsoft Windows Vista Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings Microsoft Windows Vista Audit: Shut down system immediately if unable to log security audits Microsoft Windows Vista Devices: Allowed to format and eject removable media Microsoft Windows Vista Devices: Prevent users from installing printer drivers Microsoft Windows Vista Devices: Restrict CD-ROM access to locally logged-on user only Microsoft Windows Vista Devices: Restrict Floppy access to locally logged-on user only Microsoft Windows Vista Domain member: Digitally encrypt or sign secure channel data (always) Microsoft Windows Vista Domain member: Digitally encrypt or sign secure channel data (when possible) Microsoft Windows Vista Domain member: Digitally sign secure channel data (when possible) Microsoft Windows Vista Domain member: Disable machine account password changes Microsoft Windows Vista Domain member: Maximum machine account password age Microsoft Windows Vista Domain member: Require strong (Windows 2000 or later) session key Microsoft Windows Vista Interactive logon: Do not display last user name Microsoft Windows Vista Interactive logon: Do not require CTRL+ALT+DEL Microsoft Windows Vista Interactive logon: Message text for users attempting to log on Microsoft Windows Vista Interactive logon: Message title for users attempting to log on Microsoft Windows Vista Interactive logon: Number of previous logons to cache (in case domain controller is not available) Microsoft Windows Vista Interactive logon: Prompt user to change password before expiration Microsoft Windows Vista Interactive logon: Require Domain Controller authentication to unlock workstation Microsoft Windows Vista Interactive logon: Require Domain Controller authentication to unlock workstation Microsoft Windows Vista Microsoft network client: Digitally sign communications (always) Microsoft Windows Vista Microsoft network client: Digitally sign communications (if server agrees) Microsoft Windows Vista Microsoft network client: Send unencrypted password to third-party SMB servers Microsoft Windows Vista Microsoft network server: Amount of idle time required before suspending session Microsoft Windows Vista Microsoft network server: Digitally sign communications (always) Microsoft Windows Vista Microsoft network server: Digitally sign communications (if client agrees) Microsoft Windows Vista Microsoft network server: Disconnect clients when logon hours expire Microsoft Windows Vista MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended) Microsoft Windows Vista MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended) Microsoft Windows Vista MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS) Microsoft Windows Vista MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes Microsoft Windows Vista MSS: (KeepAliveTime)How often keep-alive packets are sent in milliseconds Microsoft Windows Vista MSS: (NoDefaultExempt) Enable NoDefaultExempt for IPSec Filtering Microsoft Windows Vista MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers Microsoft Windows Vista MSS: (NtfsDisable8dot3NameCreation) Enable the computer to stop generating 8.3 style filenames (recommended) Microsoft Windows Vista MSS: (NtfsDisable8dot3NameCreation) Enable the computer to stop generating 8.3 style filenames (recommended) Microsoft Windows Vista MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended) Microsoft Windows Vista MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended) Microsoft Windows Vista MSS: (SynAttackProtect) Syn attack protection level (protects against DoS) Microsoft Windows Vista MSS: (TCPMaxConnectResponseRetransmissions) SYN-ACK retransmissions when a connection request is not acknowledged Microsoft Windows Vista MSS: (TCPMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default) Microsoft Windows Vista MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning Microsoft Windows Vista Determines if an anonymous user can request security identifier (SID) attributes for another user. Microsoft Windows Vista Network access: Do not allow anonymous enumeration of SAM accounts Microsoft Windows Vista Network access: Do not allow anonymous enumeration of SAM accounts and shares Microsoft Windows Vista Network access: Do not allow storage of credentials or .NET Passports for network authentication Microsoft Windows Vista Network access: Let Everyone permissions apply to anonymous users Microsoft Windows Vista Network access: Named Pipes that can be accessed anonymously Microsoft Windows Vista Network access: Remotely accessible registry paths Microsoft Windows Vista Network access: Remotely accessible registry paths and sub paths Microsoft Windows Vista Network access: Restrict anonymous access to Named Pipes and Shares Microsoft Windows Vista Network access: Shares that can be accessed anonymously Microsoft Windows Vista Network access: Sharing and security model for local accounts Microsoft Windows Vista Network security: Do not store LAN Manager hash value on next password change Microsoft Windows Vista Network security: Force logoff when logon hours expire Microsoft Windows Vista Network Security: LAN Manager Authentication Level Microsoft Windows Vista Network Security: LDAP client signing requirements Registry test. Determine the level of data signing that is requested by clients. Microsoft Windows Vista Network Security: Minimum session security for NTLM SSP based (including secure RPC) clients Registry test. Determine the minimum session security for NTLM SSP clients. Microsoft Windows Vista Network Security: Minimum session security for NTLM SSP based (including secure RPC) servers Microsoft Windows Vista Recovery Console: Allow Automatic Administrative Logon Microsoft Windows Vista Recovery Console: Allow Floppy Copy and Access to All Drives and All Folders Microsoft Windows Vista Shutdown: Allow System to be Shut Down Without Having to Log On Microsoft Windows Vista Shutdown: Clear Virtual Memory Pagefile Microsoft Windows Vista System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Microsoft Windows Vista System objects: Require case insensitivity for non-Windows subsystems Microsoft Windows Vista System objects: Strengthen default permissions of internal system objects Microsoft Windows Vista Administrators may access this computer from the network. NOTE: This can break IPSec see Microsoft Knowledge Base article 823659 for further guidance Microsoft Windows Vista No one has the right to act as part of the operating system Microsoft Windows Vista Administrators, LOCAL SERVICE, NETWORK SERVICE may adjust memory quotas for a process Microsoft Windows Vista Administrators and Users are allowed to log on locally Microsoft Windows Vista Administrators, Remote Desktop Users are allowed to logon through Terminal Services Microsoft Windows Vista Administrators are allowed to back up files and directories Microsoft Windows Vista Administrators, Users, Local Service and Network Service may bypass traverse checking Microsoft Windows Vista Administrators and Local Service may change the system time Microsoft Windows Vista Noone may modify an object label. Microsoft Windows Vista Administrators, Users, and Local Service may change the time zone Microsoft Windows Vista Administrators and Local Service may increase a process working set. Microsoft Windows Vista Administrators may create a pagefile Microsoft Windows Vista No one is allowed to create a token object Microsoft Windows Vista Administrators, SERVICE, Local Service and Network Service may Create Global Objects Microsoft Windows Vista No one is allowed to create permanent shared objects Microsoft Windows Vista No one is allowed to debug programs Microsoft Windows Vista Guests are denied access to this computer from the network Microsoft Windows Vista Guests are denied logon as a batch job Microsoft Windows Vista No one is denied logon as a service Microsoft Windows Vista Guests, and any service accounts are denied logon locally Microsoft Windows Vista Guests are denied logon through Terminal Services Microsoft Windows Vista Administrators may force shutdown from a remote system Microsoft Windows Vista LOCAL SERVICE and NETWORK SERVICE may generate security audits Microsoft Windows Vista Administrators, SERVICE, Local Service and Network Service may Impersonate a Client after Authentication Microsoft Windows Vista Administrators may increase scheduling priority Microsoft Windows Vista Administrators may load and unload device drivers Microsoft Windows Vista No one may lock pages in memory Microsoft Windows Vista No one may log on as a batch job Microsoft Windows Vista Noone may log on as a service Microsoft Windows Vista Administrators may manage the auditing and security log Microsoft Windows Vista Administrators may modify firmware environment variables Microsoft Windows Vista Administrators may perform volume maintenance tasks Microsoft Windows Vista Administrators may profile a single process Microsoft Windows Vista Administrators may profile the system performance Microsoft Windows Vista Users and Administrators may remove the computer from its docking station Microsoft Windows Vista LOCAL SERVICE and NETWORK SERVICE may replace a process level token Microsoft Windows Vista Administrators may restore files and directories Microsoft Windows Vista Administrators and Users may shut down the system Microsoft Windows Vista No one may synchronize directory service data Microsoft Windows Vista Administrators may take ownership of files or other objects Microsoft Windows Vista This service enumerates WLAN adapters, manages WLAN connections and profiles. Microsoft Windows Vista Turn on Mapper I/O (LLTDIO) driver Microsoft Windows Vista Turn on Responder (RSPNDR) driver Microsoft Windows Vista Turn Off Microsoft Peer-to-Peer Networking Services Microsoft Windows Vista Prohibit installation and configuration of Network Bridge on your DNS domain network Microsoft Windows Vista Prohibit use of Internet Connection Firewall on your DNS domain network Microsoft Windows Vista Prohibit use of Internet Connection Sharing on your DNS domain network Microsoft Windows Vista Configuration of Wireless Settings Using Windows Connect Now Microsoft Windows Vista Prohibit Access of the Windows Connect Now Wizards Microsoft Windows Vista Allow remote access to the PnP interface Microsoft Windows Vista Do not create system restore point when new device driver installed Microsoft Windows Vista Do not send a Windows Error Report when a generic driver is installed on a device Microsoft Windows Vista Turn Off Windows Update Device Driver Search Prompt Microsoft Windows Vista Registry Policy Processing Microsoft Windows Vista Turn Off Automatic Root Certificates Update Microsoft Windows Vista Turn off downloading of print drivers over HTTP Microsoft Windows Vista Turn Off Event Views "Events.asp" Links Microsoft Windows Vista Turn Off Handwriting Reconition Error Reporting Microsoft Windows Vista Turn Off Internet Connection Wizard if URL Connection is Referring to Microsoft.com Microsoft Windows Vista Turn off Internet download for Web publishing and online ordering wizards Microsoft Windows Vista Turn Off Internet File Association Service Microsoft Windows Vista Turn off printing over HTTP Microsoft Windows Vista Turn Off Registration if URL Connection is Referring to Microsoft.com Microsoft Windows Vista Turn off Search Companion content file updates Microsoft Windows Vista Turn Off the "Order Prints" Picture Task Microsoft Windows Vista Turn off the "Publish to Web" task for files and folders Microsoft Windows Vista Turn off the Windows Messenger Customer Experience Improvement Program Microsoft Windows Vista Turn off Windows Error Reporting Microsoft Windows Vista Turn Off Windows Movies Maker Automatic Codec Downloads Microsoft Windows Vista Turn Off Windows Movie Maker Online Web Links Microsoft Windows Vista Turn Off Windows Movie Maker Saving to Online Video Hosting Provider Microsoft Windows Vista Turn off Windows Update device driver searching Microsoft Windows Vista Always Use Classic Logon Microsoft Windows Vista Don’t Display the Getting Started Welcome Screen at Logon Microsoft Windows Vista Require a Password when a Computer Wakes (On Battery) Microsoft Windows Vista Require a Password when a Computer Wakes (Plugged) Microsoft Windows Vista Offer Remote Assistance Microsoft Windows Vista Solicited Remote Assistance Microsoft Windows Vista Turn on session logging Microsoft Windows Vista Restrictions for Unauthenticated RPC clients Microsoft Windows Vista RPC Endpoint Mapper Client Authentication Microsoft Windows Vista Disable ISATAP, Teredo, and 6to4 tunneling protocols Microsoft Windows Vista 'MSS: (NoDriveTypeAutoRun) Disable Autorun for all drives (recommended)' is set correctly. Microsoft Windows Vista Turn off Autoplay is set correctly. Microsoft Windows Vista Enumerate administrator accounts on elevation Microsoft Windows Vista Do not allow Digital Locker to run Microsoft Windows XP This definition tests the the maximum allowed size of the application log is at least as big as the supplied value. Microsoft Windows XP This definition tests the the maximum allowed size of the security log is at least as big as the supplied value. Microsoft Windows XP This definition tests the the maximum allowed size of the setup log is at least as big as the supplied value. Microsoft Windows XP This definition tests the the maximum allowed size of the system log is at least as big as the supplied value. Microsoft Windows Vista Turn Off Downloading of Game Information Microsoft Windows Vista This blocks even local Administrators from adding local web services to the Vista client Microsoft Windows Vista Disable remote Desktop Sharing Microsoft Windows Vista Specifies whether untrusted content is rendered. By default, the Help viewer renders untrusted assistance content pages with the exception of active links. Active links, such as ShellExecute and Guided Help, are rendered as text and are not clickable. Microsoft Windows Vista Allow indexing of encrypted files Microsoft Windows Vista Prevent indexing uncached Exchange folders Microsoft Windows Vista Do not allow passwords to be saved Microsoft Windows Vista Do not allow drive redirection Microsoft Windows Vista Always prompt client for password upon connection Microsoft Windows Vista Set client connection encryption level Microsoft Windows Vista You can use this policy setting to specify the maximum amount of time that a disconnected session is kept active on the server. By default, Terminal Services allows users to disconnect from a remote session without logging off and ending the session. (1 min) Microsoft Windows Vista This policy setting allows you to specify the maximum amount of time that an active Terminal Services session can be idle (without user input) before it is automatically disconnected. (15 min) Microsoft Windows Vista When Windows Defender detects software or changes by software not yet classified for risks, you see how other members responded to the alert. In turn, the action you apply help other members choose how to respond. Your actions also help Microsoft choose which software to investigate for potential threats. You can choose to send basic or additional information about detected software. Additional information helps improve how Windows Defender works. It can include, for example, the location of detected items on your computer if harmful software has been removed. Windows Defender will automatically collect and send the information. Microsoft Windows Vista If this setting is enabled Windows Error Reporting events will not be logged to the system event log. Microsoft Windows Vista If this setting is enabled, Windows Error Reporting will not send any problem information to Microsoft. Additionally, solution information will not be available in the Problem Reports and Solutions control panel. Microsoft Windows Vista Display Error Notification Microsoft Windows Vista If this setting is enabled any additional data requests from Microsoft in response to a Windows Error Reporting event will be automatically declined without notice to the user. Microsoft Windows Vista Turn off Heap termination on corruption Microsoft Windows Vista Turn off shell protocol protected mode Microsoft Windows Vista Disable IE security prompt for Windows Installer scripts Microsoft Windows Vista Permits users to change installation options that typically are available only to system administrators. This setting bypasses some of the security features of Windows Installer. Microsoft Windows Vista This setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor. Microsoft Windows Vista This setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor. Microsoft Windows Vista Windows Mail will not check your newsgroup servers for Communities support. Microsoft Windows Vista Denies or allows access to the Windows Mail application. If you enable this setting, access to the Windows Mail application is denied. If you disable or do not configure this setting, access to the Windows Mail application is allowed. Microsoft Windows Vista Prevents Windows Media Digital Rights Management (DRM) from accessing the Internet (or intranet). When enabled, Windows Media DRM is prevented from accessing the Internet (or intranet) for license acquisition and security upgrades. Microsoft Windows Vista Do Not Show First Use Dialog Boxes This policy prevents the Privacy Options and Installation Options dialog boxes from being displayed the first time a user starts Windows Media Player. This policy prevents the dialog boxes which allow users to select privacy, file types, and other desktop options from being displayed when the Player is first started. Some of the options can be configured by using other Windows Media Player group policies. When this policy is not configured or disabled, the dialog boxes are displayed when the user starts the Player for the first time. Microsoft Windows Vista Prevents users from being prompted to update Windows Media Player. This policy prevents the Player from being updated and prevents users with administrator rights from being prompted to update the Player if an updated version is available. The Check for Player Updates command on the Help menu in the Player is not available. In addition, none of the time intervals in the Check for updates section on the Player tab are selected or available. When this policy is not configured or disabled, Check for Player Updates is available only to users with administrator rights and they may be prompted to update the Player if an updated version is available. By default, users with administrator rights can select how frequently updates are checked for. Users without administrator rights do not see Check for Player Updates and are never prompted to update the Player even without this policy. Microsoft Windows Vista Windows Meeting Space is a feature that enables quick, face-to-face collaboration for sharing programs and handouts and for passing notes. If you enable this setting, Windows Meeting Space will be turned off. Microsoft Windows Vista Do not allow Windows Messenger to be run Microsoft Windows Vista todo Microsoft Windows Vista Sidebar gadgets can be deployed as compressed files, either digitally signed or unsigned. If you enable this setting, Windows Sidebar will not extract any gadgets that have not been digitally signed. If you disable or do not configure this setting, Window Microsoft Windows Vista Override the More Gadgets Lnk Microsoft Windows Vista Turn Off User Installed Windows Sidebar Gidgets Microsoft Windows Vista Password protect the screen saver Microsoft Windows Vista Screen Saver timeout Microsoft Windows Vista Prompt for password on resume from hibernate / suspend Microsoft Windows Vista Do not preserve zone information in file attachments Microsoft Windows Vista Hide mechanisms to remove zone information Microsoft Windows Vista Notify antivirus programs when opening attachments Microsoft Windows Vista Prevent users from sharing files within their profile Microsoft Windows Vista Application Group Management Microsoft Windows Vista Computer Account Management Microsoft Windows Vista Distribution Group Management Microsoft Windows Vista Other Account Management Events Microsoft Windows Vista Security Group Management Microsoft Windows Vista User Account Management Microsoft Windows Vista DPAPI Activity Microsoft Windows Vista Process Creation Microsoft Windows Vista Process Termination Microsoft Windows Vista RPC Events Microsoft Windows Vista Detailed Directory Service Replication Microsoft Windows Vista Directory Service Access Microsoft Windows Vista Directory Service Changes Microsoft Windows Vista Directory Service Replication Microsoft Windows Vista Account Lockout Microsoft Windows Vista IPsec Extended Mode Microsoft Windows Vista IPsec Main Mode Microsoft Windows Vista IPsec Quick Mode Microsoft Windows Vista Logoff Microsoft Windows Vista Logon Microsoft Windows Vista Other Logon/Logoff Events Microsoft Windows Vista Special Logon Microsoft Windows Vista Application Generated Microsoft Windows Vista Certification Services Microsoft Windows Vista File Share Microsoft Windows Vista File System Microsoft Windows Vista Filtering Platform Connection Microsoft Windows Vista Filtering Platform Packet Drop Microsoft Windows Vista Handle Manipulation Microsoft Windows Vista Kernel Object Microsoft Windows Vista Other Object Access Events Microsoft Windows Vista registry Microsoft Windows Vista SAM Microsoft Windows Vista Audit Policy Change Microsoft Windows Vista Authentication Policy Change Microsoft Windows Vista Authorization Policy Change Microsoft Windows Vista Filtering Platform Policy Change Microsoft Windows Vista MPSSVC Rule-Level Policy Change Microsoft Windows Vista Other Policy Change Events Microsoft Windows Vista Non Sensitive Privilege Use Microsoft Windows Vista Other Privilege Use Events Microsoft Windows Vista Sensitive Privilege Use Microsoft Windows Vista IPsec Driver Microsoft Windows Vista Other System Events Microsoft Windows Vista Security State Change Microsoft Windows Vista Security System Extension Microsoft Windows Vista System Integrity Microsoft Windows Vista Admin Approval Mode for the Built-in Administrator account Microsoft Windows Vista Behavior of the elevation prompt for administrators in Admin Approval Mode Microsoft Windows Vista Behavior of the elevation prompt for standard users Microsoft Windows Vista Detect application installations and prompt for elevation Microsoft Windows Vista Only elevate executables that are signed and validated Microsoft Windows Vista Only elevate UIAccess applications that are installed in secure locations Microsoft Windows Vista Run all administrators in Admin Approval Mode Microsoft Windows Vista Switch to the secure desktop when prompting for elevation Microsoft Windows Vista Virtualize file and registry write failures to per-user locations Microsoft Windows Vista Specifies whether users can provide ratings for Help content. Microsoft Windows Vista Specifies whether users can participate in the Help Experience Improvement program. Microsoft Windows Vista The operating system installed on the system is Microsoft Windows Vista Dragos Prisaca DRAFT INTERIM ACCEPTED Jonathan Baker INTERIM ACCEPTED Sudhir Gandhe INTERIM Andrew Buttner ACCEPTED ACCEPTED