accepted This guide has been created to assist IT professionals, in effectively securing systems with Microsoft Vista Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. NIST assumes no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic. NIST would appreciate acknowledgement if the document and template are used. todo - add text Trademark InformationMicrosoft, Windows, Windows XP, Windows Vista, Internet Explorer, and Windows Firewall are either registered trademarks or trademarks of Microsoft Corporation in the United States and other countries.All other names are registered trademarks or trademarks of their respective companies. National Institute of Standards and Technology SP 800-68 v1.2.0.0 This profile selects specific controls that are recommended by Special Publication 800-53 for information systems in which all three security objectives (i.e., confidentiality, integrity, and availability) are assigned a FIPS 199 potential impact value of low. Each control has an effect on other groups within this document as individual rule require certain controls to be selected. This profile selects specific controls that are recommended by Special Publication 800-53 for information systems in which at least one security objectives (i.e., confidentiality, integrity, and availability) are assigned a FIPS 199 potential impact value of moderate and no security objective is assigned a FIPS 199 potential impact value of high. Each control has an effect on other groups within this document as individual rule require certain controls to be selected. This profile selects specific controls that are recommended by Special Publication 800-53 for information systems in which at least one security objectives (i.e., confidentiality, integrity, and availability) are assigned a FIPS 199 potential impact value of high. Each control has an effect on other groups within this document as individual rule require certain controls to be selected. This profile selects all the security controls that are recommended by Special Publication 800-53 for information systems. Each control has an effect on other groups within this document as individual rule require certain controls to be selected. This profile represents guidance outlined in Federal Desktop Core Configuration for desktop systems with Microsoft Windows Vista installed. This guide has been created to assist federal agencies in effectively securing systems with Microsoft Windows Vista based on OMB Federal Desktop Core Configuration recommendations.Under the direction of OMB and in collaboration with DHS, DISA, NSA, USAF, and Microsoft, NIST has provided the following baseline to help agencies test, implement, and deploy the Microsoft Windows Vista Federal Desktop Core Configuration (FDCC) baseline. The Federal Desktop Core Configuration (FDCC) is an OMB-mandated security configuration.Please refer to the FDCC home page for additional information. http://fdcc.nist.gov FDCC has identified the following controls that must be checked in order to verify compliance. todo - description needed Attackers often attempt to gain access to user accounts by guessing passwords. Windows Vista can be configured to lock out (disable) an account when too many failed login attempts occur for a single user account in a certain time period. The following account lockout parameters are set in the NIST templates:One of the main challenges in setting account policies is balancing security, functionality, and usability. For example, locking out user accounts after only a few failed logon attempts in a long time period may make it more difficult to gain unauthorized access to accounts by guessing passwords, but may also sharply increase the number of calls to the help desk to unlock accounts accidentally locked by failed attempts from legitimate users. This could also cause more users to write down their passwords or choose easier-to-remember passwords. Organizations should carefully think out such issues before setting Windows Vista account policies. The amount of time in seconds that an account is locked before it is automatically unlocked by the system. 15 minutes = 900 seconds A value of 0 means that an administrator must unlock the account. 900 0 900 86400 The maximum number of failed attempts that can occur before the account is locked out 50 3 5 10 50 The time period in seconds to be used with the lockout threshold value. For example, if the threshold is set to 10 attempts and the duration is set to 15 minutes, then if more than 10 failed login attempts occur with a single user account within a 15-minute period, the account will be disabled. 15 minutes = 900 seconds 900 900 3600 86400 This value specifies how long the user account should be locked out. This is often set to a low but substantial value (e.g., 15 minutes), for two reasons. First, a legitimate user that is accidentally locked out only has to wait 15 minutes to regain access, instead of asking an administrator to unlock the account. Second, an attacker who is guessing passwords using brute force methods will only be able to try a small number of passwords at a time, then wait 15 minutes before trying any more. This greatly reduces the chances that the brute force attack will be successful. GPO Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy CCE-2363-0 CCE-980 The threshold value specifies the maximum number of failed attempts that can occur before the account is locked out. GPO Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy CCE-3177-3 CCE-658 This specifies the time period to be used with the lockout threshold value. For example, if the threshold is set to 10 attempts and the duration is set to 15 minutes, then if more than 10 failed login attempts occur with a single user account within a 15-minute period, the account will be disabled. GPO Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy CCE-2715-1 CCE-733 In addition to educating users regarding the selection and use of good passwords, it is also important to set password parameters so that passwords are sufficiently strong. This reduces the likelihood of an attacker guessing or cracking passwords to gain unauthorized access to the system.86 As described in Section 3.2.1, NIST recommends the use of NTLM v2 or Kerberos instead of LM or NTLM v1 for authentication. The following parameters are specified in the NIST templates: The number of passwords remembered 24 24 5 The maximum age in seconds before a password expires. (90 days = 7776000 seconds; 60 days = 5184000) 7776000 5184000 7776000 The minimum age in seconds before a password may be changed. (1 day = 86400 seconds; 5 days = 432000) 86400 86400 432000 The minimum number of characters required for a password 8 8 9 12 14 15 This value determines whether Windows Vista implements a minimum level of strong password filtering. 1 = enabled 1 0 1 This value determines whether Windows Vista is configured to prevent passwords from being stored using a two-way hash. 1 = enabled 0 0 1 This setting determines how many old passwords the system will remember for each account. Users will be prevented from reusing any of the old passwords. For example, if this is set to 24, then the system will not allow users to reuse any of their last 24 passwords. Old passwords may have been compromised, or an attacker may have taken a long time to crack encrypted passwords. Reusing an old password could inadvertently give attackers access to the system. GPO Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy CCE-2323-4 CCE-60 This forces users to change their passwords regularly. The lower this value is set, the more likely users will be to choose poor passwords that are easier for them to remember (e.g., Mypasswd1, Mypasswd2, Mypasswd3). The higher this value is set, the more likely the password will be compromised and used by unauthorized parties. GPO Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy CCE-2967-8 CCE-871 This setting requires users to wait for a certain number of days before changing their password again. The setting prevents a user from changing a password when it reaches the maximum age and then immediately changing it back to the previous password. Unfortunately, this setting also prevents users who inadvertently reveal a new password to others from changing it immediately without administrator intervention. GPO Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy CCE-3240-9 CCE-324 This setting specifies the minimum length of a password in characters. The rationale behind this setting is that longer passwords are more difficult to guess and crack than shorter passwords. The downside is that longer passwords are often more difficult for users to remember. Organizations that want to set a relatively large minimum password length should encourage their users to use passphrases, which may be easier to remember than conventional passwords. GPO Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy CCE-2883-7 CCE-100 Like the Minimum Password Length setting, this setting makes it more difficult to guess or crack passwords. Enabling this setting implements complexity requirements including not having the user account name in the password and using a mixture of character types, including upper case and lower case letters, digits, and special characters such as punctuation marks. GPO Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy CCE-3033-8 CCE-633 If this setting is enabled, passwords will be stored in a decryptible format, putting them at higher risk of compromise. This setting should be disabled unless it is needed to support a legacy authentication protocol, such as Challenge Handshake Authentication Protocol (CHAP). GPO Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy CCE-3311-8 CCE-479 todo - description needed todo - description needed Audits when a user logs on or off a remote computer from this workstation. AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE Audits when a user account or group is created, changed, or deleted; a user account is renamed, disabled, or enabled; a password is set or changed. AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE Audit Directory Service Access AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE Audits users logging on, logging off, or making a network connection to the local computer. AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE Audits a user accessing an object (for example, a file, folder, registry key, or printer) that has its own SACL specified. AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE Audits every change to user rights assignment policies, audit policies, and trust policies. AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE Audits each instance of a user exercising a user right. AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE Audits detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access. AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE Audits when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log. AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE Audits when a user logs on or off a remote computer from this workstation. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy CCE-2820-9 CCE-3089-0 CCE-2628 CCE-2543 Audits when a user account or group is created, changed, or deleted; a user account is renamed, disabled, or enabled; a password is set or changed. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy CCE-3287-0 CCE-3234-2 CCE-2000 CCE-1646 Audits the event of a user accessing an active directory object that has its own System Access Control List (SACL) specified. This setting is not applicable to Windows XP systems. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy CCE-3041-1 CCE-3309-2 CCE-2118 CCE-2390 Audits users logging on, logging off, or making a network connection to the local computer. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy CCE-3076-7 CCE-2970-2 CCE-1686 CCE-1744 Audits a user accessing an object (for example, a file, folder, registry key, or printer) that has its own SACL specified. Auditing of success or failure of system wide object access will create numerous log entries. Certain object access failures may be normal as a result of applications requesting all access types to objects, even though the application does not require all access types to function properly. Use object access auditing with caution. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy CCE-2724-3 CCE-3243-3 CCE-2640 CCE-1991 Audits every change to user rights assignment policies, audit policies, and trust policies. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy CCE-2746-6 CCE-2653-4 CCE-2412 CCE-2347 Audits each instance of a user exercising a user right. This is likely to generate a very large number of events. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy CCE-2322-6 CCE-3257-3 CCE-2431 CCE-2584 Audits detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access. Enabling this setting will generate many events, so it should only be used when absolutely necessary. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy CCE-3024-7 CCE-2927-2 CCE-2529 CCE-2617 Audits when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy CCE-2953-8 CCE-3222-7 CCE-2420 CCE-1680 Besides the Local Security Policy settings mentioned earlier in this section, additional settings called Security Options can be modified to achieve greater security than the default settings provide. The NIST templates specify values for dozens of such settings. Examples of the types of settings available are as follows: Limiting the use of blank passwords Renaming the default Administrator and Guest accounts Restricting remote access to floppy and CD-ROM drives Encrypting secure channel data in a domain Securing the interactive logon screen (e.g., not showing the previous user’s account name, displaying a warning banner, prompting users to change passwords before they expire) Restricting which types of network access may be performed Specifying which types of authentication may be used (e.g., NTLM v2). The Security Options settings can also be accessed and adjusted manually by performing the following steps: From the Start menu, choose Control Panel. Select Administrative Tools, and then choose Local Security Policy. Expand Local Policies and select Security Options. The right pane lists the security option and indicates the current setting for each. Make any necessary changes by double-clicking on the appropriate security option, modifying the setting, and clicking OK to save the change. The Administrator account status is enabled to allow the administrator to perform configuration control of the system. 1 0 1 This value defines the desired status of the built-in Guest account. 0 = disabled; 1 = enabled. 0 0 1 This value defines the desired status of limiting the use of blank passwords. 1 = enabled; 0= disabled 1 0 1 Controls the ability to audit access of global systems objects. When this setting is enabled, system objects such as mutexes, events, semaphores, and DOS devices, are created with a default system access control list (SACL). 0 0 1 Controls the ability to audit the use of all user privileges, including Backup and Restore. If this policy is disabled, certain user rights will not be audited even if "Audit privilege use" audit policy is enabled. 00 00 01 Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings 1 0 1 If events cannot be written to the security log, the system is halted immediately. If the system halts as a result of a full log, an administrator must log ont the system and clear the log. 0 0 1 Verifies that only the correct users are allowed to format and eject removable media 0 - Only Administrator, 1 - Only Administrators and power users, 2 - Only Administrators and Interactive user 0 0 1 2 Defines who is allowed to add and to delete printer drivers on the local system. 1 = Enabled; 0 = disabled 0 0 1 This value determines if access to the CDROM drive is restricted to locally logged-on users. 1 = restricted 0 0 1 This value determines if access to the floppy drive is restricted to locally logged-on users. 1 = restricted 0 0 1 Domain member: Digitally encrypt or sign secure channel data (always). Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted or signed. If this policy is enabled, outgoing secure channel traffic should be encrypted. 1 0 1 Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic should be encrypted. 1 0 1 Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, all outgoing secure channel traffic should be signed. 1 0 1 Computer account passwords are changed automatically every seven days. Enabling this policy to disable automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for your system. If this policy is disabled, a new password for the computer account will be generated every week. 1 0 1 This setting controls the maximum password age that a machine account may have. 30 7 30 This setting controls the required strength of a session key. 1 0 1 This setting determines whether the name of the last user to log on to the computer will be displayed in the Windows logon dialog box. 1 0 1 Disabling the Ctrl+Alt+Del security attention sequence can compromise system security. Because only Windows responds to the Ctrl+Alt+Del security sequence, you can be assured that any passwords you enter following that sequence are sent only to Windows. If you eliminate the sequence requirement, malicious programs can request and receive your Windows password. Disabling this sequence also suppresses a custom logon banner. 0 = disabled 0 0 1 Specifies a text message that is displayed to users when they log on. This text is often used for legal reasons, for example, to warn users about the ramifications of misusing company information or to warn them that their actions may be audited. .+ .+ The logon banner should be titled with a warning label containing the name of the owning organization. .+ .+ Defines the number of last logon credentials cached for users who log on interactively to a system. 2 0 1 2 5 10 This setting configures the system to display a warning to users telling them how many days are left before their password expires. 14 14 This setting controls the behavior of the system when you attempt to unlock the workstation. If this setting is enabled, the system will pass the credentials to the domain controller (if in a domain) for authentication before allowing the system to be unlocked. 0 0 1 This value determines the desired behavior when a smart card is removed. 0 - No action 1 - Lock workstation 2 - Force logoff 1 0 1 2 This check verifies that the client policy is set to always sign packets. 0 0 1 This check verifies that the client policy is set to sign packets if the server agrees. 1 0 1 Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication. Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment. Check with the Vendor of the SMB server to see if there is a way to support encrypted password authentication. 0 0 1 Administrators should use this setting to control when a computer disconnects an inactive SMB session. If client activity resumes, the session is automatically reestablished. 15 15 This check verifies that the server policy is set to always sign packets. 1 0 1 Microsoft network server: Digitally sign communications (if client agrees). This check verifies that the server policy is set to sign packets if the client agrees. 1 0 1 Users should not be permitted to remain logged on to the network after they have exceeded their permitted logon hours. In many cases, this indicates that a user forgot to log off before leaving for the day. However, it may also indicate that a user is attempting unauthorized access at a time when the system may be less closely monitored. 1 0 1 Determines whether the automatic logon feature is enabled. Automatic logon uses the domain, user name, and password stored in the registry to log users on to the computer when the system starts. The Log On to Windows dialog box is not displayed. 0 0 1 todo - description needed 0 0 1 2 todo - description needed 0 0 1 todo - description needed 0 0 1 This value controls how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet. If the remote computer is still reachable, it acknowledges the keep-alive packet. HKLM\System\CurrentControlSet\Tcpip\Parameters\KeepAliveTime 300000 300000 Network basic input/output system (NetBIOS) over TCP/IP is a networking protocol that, among other things, provides a means of easily resolving NetBIOS names registered on Windows- based systems to the IP addresses configured on those systems. This value determines whether the computer releases its NetBIOS name when it receives a name release request. The NoNameReleaseOnDemand setting configures the system to refuse name release requests to release its SMB name. This setting prevents an attacker from sending a name release request to a server, causing the server to be inaccessible to legitimate clients. If this setting is configured on a client, however, and that client is mis-configured with the same name as a critical server, the server will be unable to recover the name, and legitimate requests may be directed to the rogue server instead, causing a denial of service condition at best. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netbt\Parameters\ NoNameReleaseOnDemand registry key. 1 0 1 Vista supports 8.3 file name formats for backward compatibility with 16- bit applications. The 8.3 file name convention is a naming format that allows file names that are up to eight characters in length. The following registry value entry has been added to the template in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem\ NtfsDisable8dotNameCreation registry key. 1 0 1 This setting is used to enable or disabled the Internet Router Discovery Protocol (IRDP). IRDP allows the system to detect and configure Default Gateway addresses automatically. HKLM\System\CurrentControlSet\Tcpip\Parameters\PerformRouterDiscovery 0 0 1 2 Most programs on the Windows platform make use of various Dynamic Link Libraries (DLL) to avoid having to reimplement functionality. The operating system actually loads several DLLs for each program, depending on what type of program it is. When the program does not specify an absolute location for a DLL, the default search order is used to locate it. By default, the search order used by the operating system is as follows: 1. Memory 2. KnownDLLs 3. Manifests and .local 4. Application directory 5. Current working directory 6. System directories (%systemroot%, %systemroot%\system, and %systemroot%\system32) 7. The path variable The fact that the current working directory is searched before the system directories can be used by someone with access to the file system to cause a program launched by a user to load a spoofed DLL. If a user launches a program by double-clicking a document, the current working directory is actually the location of the document. If a DLL in that directory has the same name as a system DLL in that location will then be loaded instead of the system DLL. This attack vector was actually used by the Nimda virus. To combat this, a new setting was created in Service Pack 3, which moves the current working directory to after the system directories in the search order. To avoid application compatibility issues, however, this switch was not turned on by default. To turn it on, set the following registry valueMACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode 1 0 1 Setting Added to Registry to Make Screensaver Password Protection Immediate The default grace period allowed for user movement before the screen – saver lock takes effect is five seconds. Leaving the grace period in the default setting makes your computer vulnerable to a potential attack from someone walking up to the console to attempt to log onto the system before the lock takes effect. An entry to the registry can be made to adjust the length of the grace period. 0 0 5 This registry value causes TCP to adjust retransmission of SYN- ACKs. When you configure this value, the connection responses time- out more quickly in the event of a connect request (SYN) attack. 1 = Connections timeout more quickly if a SYN attack is detected 0 = No additional protection, use default settings Note: W2K had another option = 2 that has been incorporated into option 1 in W2K3. HKLM\System\CurrentControlSet\Tcpip\Parameters\SynAttackProtect 1 0 1 This parameter determines the number of times that TCP retransmits a SYN before aborting the attempt. The retransmission time-out is doubled with each successive retransmission in a given connect attempt. The initial time-out value is three seconds. 0 = No retransmission, half- open connections dropped after 3 seconds 1 = 3 seconds, half- open connections dropped after 9 seconds 2 = 3 and 6 seconds, half- open connections dropped after 21 seconds 3 = 3, 6, and 9 seconds, half- open connections dropped after 45 seconds HKLM\System\CurrentControlSet\Tcpip\Parameters\TcpMaxConnectResponseRetransmissions 2 0 1 2 3 MSS: (TCPMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default) 3 3 5 Windows Server 2003 and Service Pack 3 for Windows 2000 include a new feature for generating a security audit in the security event log when the security log reaches a user defined threshold. Note: new to W2K3 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\WarningLevel 90 90 todo - description needed False False True todo - description needed 1 0 1 todo - description needed 1 0 1 Network access: Do not allow storage of credentials or .NET Passports for network authentication 1 0 1 Network access: Let Everyone permissions apply to anonymous users 0 0 1 Network access: Restrict anonymous access to Named Pipes and Shares 1 0 1 Network access: Sharing and security model for local accounts 0 0 1 Network security: Do not store LAN Manager hash value on next password change Enabled Disabled Enabled Network security: Force logoff when logon hours expire 0 0 1 Network Security: LAN Manager Authentication Level 3 0 1 2 3 4 5 Network Security: LDAP client signing requirements 1 0 1 2 Network Security: Minimum session security for NTLM SSP based (including secure RPC) clients 537395200 537395200 Network Security: Minimum session security for NTLM SSP based (including secure RPC) servers 537395200 537395200 Recovery Console: Allow Automatic Administrative Logon 0 0 1 Recovery Console: Allow Floppy Copy and Access to All Drives and All Folders 0 0 1 Shutdown: Allow System to be Shut Down Without Having to Log On 0 0 1 Shutdown: Clear Virtual Memory Pagefile 1 0 1 System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing 0 0 1 System objects: Require case insensitivity for non-Windows subsystems 0 0 1 System objects: Strengthen default permissions of internal system objects 1 0 1 The Administrator account status is enabled to allow the administrator to perform configuration control of the system. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3032-0 CCE-499 A system faces an increased vulnerability threat if the built-in guest account is not disabled. This account is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned. This account is a member of the Everyone user group and has all the rights and permissions associated with that group, which could subsequently provide access to system resources to anonymous users. Ensure the built-in guest account is disabled. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3248-2 CCE-332 In Windows Vista, accounts with null or blank passwords can only be used to log on at the physical system’s logon screen. This means that accounts with blank or null passwords cannot be used over networks or with the secondary logon service (RunAs). This feature prevents attackers and malware from gaining remote access through blank passwords. Section 6 contains information on other recommended password settings. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2398-6 CCE-533 The Administrator account is created by default when installing Windows Vista, but is disabled. Associating the Administrator SID with a different name may thwart a potential hacker who is targeting the built-in Administrator account. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2714-4 CCE-438 The Guest account is created by default when installing Windows Vista, but is disabled. Associating the Guest SID with a different name may thwart a potential hacker who is targeting the built-in Guest account. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2359-8 CCE-834 Controls the ability to audit access of global systems objects. When this setting is enabled, system objects such as mutexes, events, semaphores, and DOS devices, are created with a default system access control list (SACL). GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3285-4 CCE-2 Controls the ability to audit the use of all user privileges, including Backup and Restore. If this policy is disabled, certain user rights will not be audited even if "Audit privilege use" audit policy is enabled. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3303-5 CCE-905 Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3450-4 CCE-111 If events cannot be written to the security log, the system is halted immediately. If the system halts as a result of a full log, an administrator must log ont the system and clear the log. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3001-5 CCE-92 Verifies that only the correct users are allowed to format and eject removable media> GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3225-0 CCE-919 This setting determines who is allowed to install a printer driver as part of adding a network printer. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3325-8 CCE-402 Removable media devices (CD-ROM) are readable by others on the network if they are not properly configured. A process can remain running in the background after a user logs off, thereby, permitting access to the media, while another user is logged on to the system. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2858-9 CCE-565 Removable media devices (floppy disks) are readable by others on the network if they are not properly configured. A process can remain running in the background after a user logs off, thereby, permitting access to the media, while another user is logged on to the system. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3168-2 CCE-463 Domain member: Digitally encrypt or sign secure channel data (always). Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted or signed. If this policy is enabled, outgoing secure channel traffic should be encrypted. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3330-8 CCE-549 Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic should be encrypted. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2467-9 CCE-161 Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, all outgoing secure channel traffic should be signed. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3233-4 CCE-918 Computer account passwords are changed automatically every seven days. Enabling this policy to disable automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for your system. If this policy is disabled, a new password for the computer account will be generated every week. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3255-7 CCE-831 This setting controls the maximum password age that a machine account may have. This setting should be set to no more that 30 days, ensuring that the machine changes its password monthly. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3075-9 CCE-194 This setting controls the required strength of a session key. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3212-8 CCE-417 This setting determines whether the name of the last user to log on to the computer will be displayed in the Windows logon dialog box. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3173-2 CCE-65 Disabling the Ctrl+Alt+Del security attention sequence can compromise system security. Because only Windows responds to the Ctrl+Alt+Del security sequence, you can be assured that any passwords you enter following that sequence are sent only to Windows. If you eliminate the sequence requirement, malicious programs can request and receive your Windows password. Disabling this sequence also suppresses a custom logon banner. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3307-6 CCE-133 Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3336-5 CCE-829 The logon banner should be titled with a warning label containing the name of the owning organization. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3314-2 CCE-23 The default Windows XP configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons such as the users machine is disconnected from the network or domain controllers are not available. Even though the credential cache is well-protected, storing encrypted copies of users passwords on workstations do not always have the same physical protection required for domain controllers. If a workstation is attacked, the unauthorized individual may isolate the password to a domain user account using a password-cracking program, and gain access to the domain. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2376-2 CCE-773 This setting configures the system to display a warning to users telling them how many days are left before their password expires. By giving the user advanced warning, the user has time to construct a sufficiently strong password. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3230-0 CCE-814 This setting controls the behavior of the system when you attempt to unlock the workstation. If this setting is enabled, the system will pass the credentials to the domain controller (if in a domain) for authentication before allowing the system to be unlocked. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3220-1 CCE-374 When the smart card for a logged-on user is removed from the smart card reader, the workstation should be locked. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3251-6 CCE-443 This check verifies that the client policy is set to always sign packets. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3252-4 CCE-576 This check verifies that the client policy is set to sign packets if the server agrees. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2380-4 CCE-519 Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication. Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment. Check with the Vendor of the SMB server to see if there is a way to support encrypted password authentication. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2838-1 CCE-228 Administrators should use this setting to control when a computer disconnects an inactive SMB session. If client activity resumes, the session is automatically reestablished. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2519-7 CCE-222 This check verifies that the server policy is set to always sign packets. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3023-9 CCE-171 Microsoft network server: Digitally sign communications (if client agrees). This check verifies that the server policy is set to sign packets if the client agrees. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3164-1 CCE-104 Users should not be permitted to remain logged on to the network after they have exceeded their permitted logon hours. In many cases, this indicates that a user forgot to log off before leaving for the day. However, it may also indicate that a user is attempting unauthorized access at a time when the system may be less closely monitored. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3361-3 CCE-278 Determines whether the automatic logon feature is enabled. Automatic logon uses the domain, user name, and password stored in the registry to log users on to the computer when the system starts. The Log On to Windows dialog box is not displayed. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3072-6 CCE-283 MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing) GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3261-5 CCE-564 MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways (could lead to DoS) GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3120-3 CCE-897 MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3239-1 CCE-150 This value controls how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet. If the remote computer is still reachable, it acknowledges the keep-alive packet. HKLM\System\CurrentControlSet\Tcpip\Parameters\KeepAliveTime GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3142-7 CCE-188 MSS: (NoDefaultExempt) Enable NoDefaultExempt for IPSec Filtering GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4904-9 CCE-501 Disable Autorun on all drives, any pluggable device included (not just CDs) Affects registry key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2719-3 CCE-44 Network basic input/output system (NetBIOS) over TCP/IP is a networking protocol that, among other things, provides a means of easily resolving NetBIOS names registered on Windows- based systems to the IP addresses configured on those systems. This value determines whether the computer releases its NetBIOS name when it receives a name release request. The NoNameReleaseOnDemand setting configures the system to refuse name release requests to release its SMB name. This setting prevents an attacker from sending a name release request to a server, causing the server to be inaccessible to legitimate clients. If this setting is configured on a client, however, and that client is mis-configured with the same name as a critical server, the server will be unable to recover the name, and legitimate requests may be directed to the rogue server instead, causing a denial of service condition at best. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netbt\Parameters\ NoNameReleaseOnDemand registry key. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2785-4 CCE-817 Vista supports 8.3 file name formats for backward compatibility with 16- bit applications. The 8.3 file name convention is a naming format that allows file names that are up to eight characters in length. The following registry value entry has been added to the template in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem\ NtfsDisable8dotNameCreation registry key. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3244-1 CCE-511 This setting is used to enable or disabled the Internet Router Discovery Protocol (IRDP). IRDP allows the system to detect and configure Default Gateway addresses automatically. HKLM\System\CurrentControlSet\Tcpip\Parameters\PerformRouterDiscovery GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3279-7 CCE-952 Most programs on the Windows platform make use of various Dynamic Link Libraries (DLL) to avoid having to reimplement functionality. The operating system actually loads several DLLs for each program, depending on what type of program it is. When the program does not specify an absolute location for a DLL, the default search order is used to locate it. By default, the search order used by the operating system is as follows: 1. Memory 2. KnownDLLs 3. Manifests and .local 4. Application directory 5. Current working directory 6. System directories (%systemroot%, %systemroot%\system, and %systemroot%\system32) 7. The path variable The fact that the current working directory is searched before the system directories can be used by someone with access to the file system to cause a program launched by a user to load a spoofed DLL. If a user launches a program by double-clicking a document, the current working directory is actually the location of the document. If a DLL in that directory has the same name as a system DLL in that location will then be loaded instead of the system DLL. This attack vector was actually used by the Nimda virus. To combat this, a new setting was created in Service Pack 3, which moves the current working directory to after the system directories in the search order. To avoid application compatibility issues, however, this switch was not turned on by default. To turn it on, set the following registry valueMACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3199-7 CCE-271 Setting Added to Registry to Make Screensaver Password Protection Immediate The default grace period allowed for user movement before the screen – saver lock takes effect is five seconds. Leaving the grace period in the default setting makes your computer vulnerable to a potential attack from someone walking up to the console to attempt to log onto the system before the lock takes effect. An entry to the registry can be made to adjust the length of the grace period. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3050-2 CCE-830 This registry value causes TCP to adjust retransmission of SYN- ACKs. When you configure this value, the connection responses time- out more quickly in the event of a connect request (SYN) attack. 1 = Connections timeout more quickly if a SYN attack is detected 0 = No additional protection, use default settings Note: W2K had another option = 2 that has been incorporated into option 1 in W2K3. HKLM\System\CurrentControlSet\Tcpip\Parameters\SynAttackProtect GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2679-9 CCE-284 This parameter determines the number of times that TCP retransmits a SYN before aborting the attempt. The retransmission time-out is doubled with each successive retransmission in a given connect attempt. The initial time-out value is three seconds. 0 = No retransmission, half- open connections dropped after 3 seconds 1 = 3 seconds, half- open connections dropped after 9 seconds 2 = 3 and 6 seconds, half- open connections dropped after 21 seconds 3 = 3, 6, and 9 seconds, half- open connections dropped after 45 seconds HKLM\System\CurrentControlSet\Tcpip\Parameters\TcpMaxConnectResponseRetransmissions GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3459-5 CCE-577 MSS: (TCPMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default) GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3460-3 CCE-872 Windows Server 2003 and Service Pack 3 for Windows 2000 include a new feature for generating a security audit in the security event log when the security log reaches a user defined threshold. Note: new to W2K3 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\WarningLevel GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3181-5 CCE-125 Determines if an anonymous user can request security identifier (SID) attributes for another user or use a SID to get the corresponding username. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2339-0 CCE-953 If this setting is disabled, it allows anonymous logon users (null session connections) to list all account names, thus providing a map of potential points to attack the system. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3272-2 CCE-318 If this setting is disabled, it allows anonymous logon users (null session connections) to list all account names and enumerate all shared resources, thus providing a map of potential points to attack the system. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3232-6 CCE-195 This setting controls the storage of authentication credentials or .NET passports on the local system. Such credentials should never be stored on the local machine as that may lead to account compromise. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3379-5 CCE-542 This setting helps define the permissions that anonymous users have. If this setting is enabled then anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users should not have these permissions or rights. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2457-0 CCE-18 Network access: Named Pipes that can be accessed anonymously. Pipes are internal system communications processes. They are identified internally by ID numbers that vary between systems. To make access to these processes easier, these pipes are given names that do not vary between systems. This setting controls which of these pipes anonymous users may access. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3380-3 CCE-136 Network access: Remotely accessible registry paths(System\CurrentControlSet\Control\ProductOptions; System\CurrentControlSet\Control\Server Applications; Software\Microsoft\Windows NT\CurrentVersion) GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-2825-8 CCE-189 Network access: Remotely accessible registry paths ("Software\Microsoft\Windows NT\CurrentVersion\Print, Software\Microsoft\Windows NT\CurrentVersion\Windows, System\CurrentControlSet\Control\Print\Printers, System\CurrentControlSet\Services\Eventlog, Software\Microsoft\OLAP Server, System\CurrentControlSet\Control\ContentIndex, System\CurrentControlSet\Control\Terminal Server, System\CurrentControlSet\Control\Terminal Server\UserConfig, System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration, Software\Microsoft\Windows NT\CurrentVersion\Perflib, System\CurrentControlSet\Services\SysmonLog") GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4781-1 CCE-1185 This check determines whether anonymous access is restricted to named pipes and shares. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3292-0 CCE-638 This setting controls which network shares may be accessed by an anonymous user. The default setting includes the shares, DFS$, and COMCFG. It is recommended that they be left as the default setting. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3349-8 CCE-942 Windows XP includes two network-sharing security models Classic and Guest only. It is recommended that the Classic mode be used. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3367-0 CCE-343 This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed. The LAN Manager hash is a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3138-5 CCE-233 This setting controls whether or not users are forced to log off when their allowed logon hours expire. If logon hours are set for users, then this should be enforced. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3283-9 CCE-775 Windows network authentication has changed considerably as various security vulnerabilities have been identified and fixed. The original LAN Manager (or LM) password hash is considered very weak, but is still used by most Windows 9x clients. Using commercially available software, and off-the-shelf computers, most LM password hashes can be used to reveal the actual password in a matter of days, or hours. With the release of Windows NT 4.0, Microsoft developed NTLM authentication. Serious vulnerabilities made NTLM almost as easy to crack as LM, so NTLM version 2 (NTLMv2) was introduced. NTLMv2 provides significant improvements to security; when combined with strong password policy, accounts are well protected against brute force attacks. All of these authentication methods are incorporated into Windows 2000. All authentication models work with a hash of the password, not the password itself. This presents challenges with down-level compatibility between operating systems. In order to smooth the transition, when one computer attempts to authenticate with another, the default behavior is to send the basic LM hash along with the more secure NTLM hash. This setting improves control over the response to an authentication challenge: Send LM and NTLM responses, Send LM and NTLM, Use NTLMv2 session security if negotiated, Send NTLM response only, Send NTLMv2 response only, Send NTLMv2 response only\refuse LM, Send NTLMv2 response only\refuse LM and NTLM, The default, and weakest option, is the first: send LM and NTLM responses. As a result, using NTLM is ineffective because both protocols are sent together. In order to take a much more effective stand to protect network authentication, set LAN Manager Authentication Level to Send NTLMv2 response only\refuse LM and NTLM. Enabling this setting may have adverse effects on your ability to communicate with other Windows machines unless the change is made network-wide. If you find that you are unable to require a certain level of LM Authentication, back down to “Send LM and NTLM – Use NTLMv2 session security if negotiated” and try your network authentication again. Communication with Windows 9x/Me machines requires the DSCLIENT.EXE utility from the Windows 2000 installation CD. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4922-1 CCE-719 Similar to the SMB protocol, the LDAP protocol supports signing. LDAP, “Lightweight Directory Access Protocol,” provides one means for the client to talk to active directory. LDAP protocol is text-based, but supports authentication to gain access to sensitive sections of the directory. Require signing to provide the assurance of mutual authentication for this communications channel. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4940-3 CCE-732 NTLM authentication can provide a security service to manage connection between various clients and servers, including through the Remote Procedure Call (RPC) service. Windows 2000 improved the security model for secure, authenticated client-server communications; this setting manages the new features for communications established by this workstation. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4583-1 CCE-674 Similar to "Network Security: Minimum session security for NTLM SSP based (including secure RPC) clients", this setting manages features for communication services provided by this workstation to other computers. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4213-5 CCE-766 The Recovery Console, new to Windows 2000 and XP, provides a limited command-line access to an otherwise unbootable operating system. The console allows access to the NTFS file system, which does not natively allow access when the operating system becomes unbootable. Other third-party applications have been developed to perform this action as well, but the Recovery Console is part of the operating system. It can be installed from the Windows 2000 CD with the “d:\i386\winnt32.exe /cmdcons” command. It can also be run directly from the Windows 2000 installation CD. The Recovery Console does not grant full and unrestricted access to the operating system by default. It does require that you log on using the password of the default Administrator account. Keep in mind that this must be the local administrator account, not just a member of the local administrators group. Also, the policy for renaming the administrator account does not apply to the recovery console, and that password must be used. If configured, a boot to the recovery console could result in automatic logon, and bypass the need for the password of the administrator account. Since this gives administrator access to anyone who can reboot the computer, the setting is generally disabled. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4107-9 CCE-410 By default, the Recovery Console only allows access to the root folder of each drive, and the operating system folder (typically C:\Windows). The console also prevents copying files from the hard drive onto removable media. Although this protection can be bypassed by enabling floppy copy and drive access, the setting is enabled by default and should remain disabled. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3953-7 CCE-76 Some systems run critical processes and should only be shut down by authorized users. Occasionally, special processes could be evoked during system startup, sometimes even trojaned processes. In environments where abnormal system reboots could cause problems, require a logon prior to reboot. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3954-5 CCE-224 Virtual memory extends the physical memory available to the CPU. As data and applications fill the available physical memory, the operating system writes less-frequently used pages of memory out to disk, into the virtual memory pagefile. This greatly extends the amount of “virtual” memory available to the computer. Since the pagefile contains information that was in memory, it potentially holds a great deal of information useful for an attacker. Digging through the pagefile can reveal SSL web pages, queries set from the client to databases, sometimes even user ids and passwords from poorly written applications. The workstation does not clean this information from the pagefile on shutdown. Although the file can not be accessed when booted in Windows, anyone booting the workstation to an alternate operating system (e.g., from a boot CD) may access the page file. Enabling this options provides greater security by erasing the data during normal operations; however, this may also significantly increase the time required to shut down the computer. When enabled, the hibernation file (hiberfil.sys) is also cleaned on shutdown. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-3969-3 CCE-422 System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4774-6 CCE-55 The Windows operating systems ignore case when accessing resources; for example, “C:\Windows”, “C:\WINDOWS” and “c:\windows” all refer to the same directory. However, the Windows kernel allows interfaces with other case-sensitive operating systems (e.g., Unix). Enabling this setting causes the interoperability features to be case-insensitive as well. This setting has no effect when the workstation communicates only with other Windows systems. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4841-3 CCE-300 This setting actually digs deep into the operating system behavior and should be left at the default setting (Enabled) unless explicitly required. “Internal system objects” are shared physical and logical resources such as semaphores and DOS device name; the objects all are created with access control lists (ACLs). When enabled, the ACL allows other non-administrative system processes to query internal system objects, but will not allow them to modify them. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4011-3 CCE-508 User Account Control (UAC) is a new security component in Windows Vista. UAC enables users to perform common tasks as non-administrators, called standard users in Windows Vista, and as administrators without having to switch users, log off, or use Run As. A standard user account is synonymous with a user account in Windows XP. User accounts that are members of the local Administrators group will run most applications as a standard user. By separating user and administrator functions while enabling productivity, UAC is an important enhancement for Windows Vista. This security setting determines the behavior of Admin Approval Mode for the Built-in Administrator account. 0 0 1 This security setting determines the behavior of the elevation prompt for administrators. 0 0 1 2 This security setting determines the behavior of the elevation prompt for standard users. 0 0 1 This security setting determines the behavior of application installation detection for the computer. 0 0 1 This security setting will enforce public key infrastructure (PKI) signature checks on any interactive application that requests elevation of privilege. Enterprise administrators can control which administrative applications are allowed through the certificates in the local computer's Trusted Publishers certificate store. 0 0 1 This security setting will enforce the requirement that applications requesting to be run with a UIAccess integrity level must reside in a secure location on the file system. 0 0 1 This security setting determines the behavior of all UAC policies for the entire system. 0 0 1 This security setting determines whether the elevation prompt appears on the interactive user's desktop or the secure desktop. 0 0 1 This security setting enables the redirection of application write failures to defined locations in both the registry and file system. This feature mitigates those applications that historically ran as administrator and wrote runtime application data to protected locations (%ProgramFiles%, %Windir%, %Windir%\system32, or HKLM\Software\...). Virtualization facilitates the running of applications that historically failed to run as standard user because of application write failures. 0 0 1 The "User Account Control: Admin Approval Mode for the Built-in Administrator account" setting should be configured correctly. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4955-1 CCE-1078 The "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" setting should be configured correctly. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4016-2 CCE-1063 The "User Account Control: Behavior of the elevation prompt for standard users" setting should be configured correctly. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4969-2 CCE-1067 The "User Account Control: Detect application installations and prompt for elevation" setting should be configured correctly. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4612-8 CCE-1128 The "User Account Control: Only elevate executables that are signed and validated" setting should be configured correctly. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-5004-7 CCE-1104 The "User Account Control: Only elevate UIAccess applications that are installed in secure locations" setting should be configured correctly. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4020-4 CCE-986 The "User Account Control: Run all administrators in Admin Approval Mode" setting should be configured correctly. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4907-2 CCE-1050 The "User Account Control: Switch to the secure desktop when prompting for elevation" setting should be configured correctly. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4925-4 CCE-230 The "User Account Control: Virtualize file and registry write failures to per-user locations" setting should be configured correctly. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options CCE-4194-7 CCE-673 The NIST security templates specify which groups (e.g., Administrators, Users) have certain user rights. The goal is for each group to have only the necessary rights, and for users to only belong to the necessary groups. This is the principle of least privilege, described previously in Section 2.2. Examples of user rights that can be specified are as follows: Accessing the system remotely and locally Performing backups Changing the time and date on the system Managing the logs Shutting down the system. Verify that the user right '' has been granted appropriately. Verify that the user right 'Access This Computer From The Network' has been granted appropriately. (Only Administrators) NOTE: This can break IPSec see Microsoft Knowledge Base article 823659 for further guidance GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4334-9 CCE-532 Verify that the user right 'Act As Part Of The Operating System' has been granted appropriately. (No One) GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4088-1 CCE-162 Verify that the user right 'Adjust Memory Quotas For A Process' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4854-6 CCE-807 Verify that the user right 'Allow Log On Locally' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4872-8 CCE-965 Verify that the user right 'Allow Log On Through Terminal Services' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4264-8 CCE-883 Verify that the user right 'Back Up Files and Directories' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4827-2 CCE-931 Verify that the user right 'Bypass Traverse Checking' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4973-4 CCE-376 Verify that the user right 'Change the System Time' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4863-7 CCE-799 The "Change the time zone" user right should be assigned to the appropriate accounts. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-5008-8 CCE-470 Verify that the user right 'Create A Pagefile' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4757-1 CCE-895 Verify that the user right 'Create A Token Object' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4902-3 CCE-926 Verify that the user right 'Create Global Objects' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4792-8 CCE-383 Verify that the user right 'Create Permanent Shared Objects' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4184-8 CCE-335 Verify that the user right 'Debug Programs' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4687-0 CCE-842 Verify that the user right 'Deny Access To This Computer From The Network' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4704-3 CCE-898 Verify that the user right 'Deny Logon As A Batch Job' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4722-5 CCE-165 Verify that the user right 'Deny Logon As A Service' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4867-8 CCE-597 Verify that the user right 'Deny Logon Locally' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4889-2 CCE-64 Verify that the user right 'Deny Logon Through Terminal Services' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4656-5 CCE-108 Verify that the user right 'Force Shutdown From A Remote System' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4673-0 CCE-754 Verify that the user right 'Generate Security Audits' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4488-3 CCE-939 Verify that the user right 'Impersonate a Client After Authentication' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4382-8 CCE-304 The "Increase a Process Working Set" setting should be configured correctly. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4651-6 CCE-1027 Verify that the user right 'Increase Scheduling Priority' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4796-9 CCE-349 Verify that the user right 'Load And Unload Device Drivers' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4034-5 CCE-860 Verify that the user right 'Lock Pages In Memory' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4317-4 CCE-749 Verify that the user right 'Log On As A Batch Job' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4083-2 CCE-177 Verify that the user right 'Log On As A Service' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4038-6 CCE-216 Verify that the user right 'Manage Auditing And Security Log' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4046-9 CCE-850 The "Modify an object label" user right should be assigned to the appropriate accounts. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4285-3 CCE-1023 Verify that the user right 'Modify Firmware Environment Values' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4048-5 CCE-17 Verify that the user right 'Perform Volume Maintenance Tasks' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4071-7 CCE-314 Verify that the user right 'Profile Single Process' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4962-7 CCE-260 Verify that the user right 'Profile System Performance' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4618-5 CCE-599 Verify that the user right 'Remove Computer From Docking Station' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4861-1 CCE-656 Verify that the user right 'Replace A Process Level Token' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4372-9 CCE-667 Verify that the user right 'Restore Files And Directories' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4948-6 CCE-553 Verify that the user right 'Shut Down The System' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4569-0 CCE-839 Verify that the user right 'Synchronize Directory Service Data' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4970-0 CCE-381 Verify that the user right 'Take Ownership Of Files Or Other Objects' has been granted appropriately. GPO Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment CCE-4988-2 CCE-492 todo - description needed todo - description needed WLAN AutoConfig 4 0 1 2 3 4 This service enumerates WLAN adapters, manages WLAN connections and profiles. GPO Computer Configuration\Windows Settings\Security Settings\System Services CCE-4627-6 CCE-957 FDCC has identified the following additional controls that must be checked in order to verify compliance. todo - description needed The Link Layer Topology Discovery (LLTD) specification describes how the LLTD protocol operates over wired (802.3 Ethernet) and wireless (802.11) media. LLTD enables device discovery via the data-link layer and determines the topology of a network. This specification also describes the Quality of Service (QoS) Extensions that enable stream prioritization and quality media streaming experiences, even on networks with limited bandwidth. This policy setting turns on the Mapper I/O network protocol driver. (Enabled=1; Disabled=0; Not Configured) 0 0 1 This policy setting turns on the Responder network protocol driver. (Enabled=1; Disabled=0; Not Configured) 0 0 1 This policy setting turns on the Mapper I/O network protocol driver. LLTDIO allows a computer to discover the topology of a network it's connected to. GPO Computer Configuration\Administrative Templates\Network\Link-Layer Topology Discovery CCE-4992-4 CCE-347 This policy setting turns on the Responder network protocol driver. The Responder allows a computer to participate in Link Layer Topology Discovery requests so that it can be discovered and located on the network. GPO Computer Configuration\Administrative Templates\Network\Link-Layer Topology Discovery CCE-4077-4 CCE-1134 todo - description needed This setting turns off Microsoft Peer-to-Peer Networking Services. (Enabled=1; Disabled=0; Not Configured) 1 0 1 This setting turns off Microsoft Peer-to-Peer Networking Services in its entirety, and will cause all dependent applications to stop working. GPO Computer Configuration\Administrative Templates\Network\Microsoft Peer-to-Peer Networking Services CCE-3270-6 CCE-86 The features for implementing and administering small networks are described as follows:-- Internet Connection Sharing (ICS) --ICS provides Internet access for a home or small office network by using one common connection as the Internet gateway. The ICS host is the only computer that is directly connected to the Internet. Multiple ICS clients simultaneously use the common Internet connection and benefit from Internet services as if the clients were directly connected to the Internet service provider (ISP). Security is enhanced when ICS is enabled because only the ICS host computer is visible to the Internet. The addresses of ICS clients are hidden from the Internet rendering ICS clients invisible to the Internet. In addition, ICS simplifies the configuration of small networks by providing local private network services, such as name resolution and addressing.Note: You should not use Internet Connection Sharing in an existing network with Windows 2000 Server domain controllers, Domain Name System (DNS) servers, gateways, Dynamic Host Configuration Protocol (DHCP) servers, or systems configured for static IP addresses.-- Internet Connection Firewall (ICF) --With ICF, the firewall checks all communications that cross the connection between your network and the Internet and is selective about which responses from the Internet it allows. ICF protects only the computer on which it is enabled. If ICF is enabled on the Internet Connection Sharing (ICS) host computer, however, ICS clients that use the shared Internet connection for Internet connectivity are protected because they cannot be seen from outside your network. For this reason, you should always enable ICF on the ICS host computer. In addition, if there are clients on your network with direct Internet connections, or if you have a stand-alone computer that is connected to the Internet, then you should enable ICF on those Internet connections as well.-- Network Bridge --Network Bridge removes the need for routing and bridging hardware in a home or small office network that consists of multiple LAN segments. With Network Bridge, multiple LAN segments become a single IP subnet, even if the LAN segments are of mixed network media types. Network Bridge automates the configuration and management of the address allocation, routing, and name resolution that is typically required in a network that consists of multiple LAN segments.Caution If neither ICF nor ICS is enabled on your network, do not set up Network Bridge between the public Internet connection and the private network connection. Setting up Network Bridge between the public Internet connection and the private network connection creates an unprotected link between your network and the Internet, leaving your network vulnerable to external attacks. When either ICF or ICS is enabled, this risk is mitigated. todo - description needed 1 1 0 todo - description needed 1 1 0 todo - description needed 1 1 0 Installation and Configuration of Network Bridge on the DNS Domain Network should be properly configured. GPO Computer Configuration\Administrative Templates\Network\Network Connections CCE-4152-5 CCE-896 The "Prohibit use of Internet Connection Firewall on your DNS domain network" setting should be configured correctly. GPO Computer Configuration\Administrative Templates\Network\Network Connections CCE-5020-3 CCE-241 The "Prohibit use of Internet Connection Sharing on your DNS domain network" setting should be configured correctly. GPO Computer Configuration\Administrative Templates\Network\Network Connections CCE-4078-2 CCE-672 todo - description needed Configuration of Wireless Settings Using Windows Connect Now. (Enabled = 0; Disabled = 1) 0 0 1 Prohibit Access of the Windows Connect Now Wizards. (Enabled = 1; Disabled = 0) 0 0 1 Configuration of Wireless Settings Using Windows Connect Now GPO Computer Configuration\Administrative Templates\Network\Windows Connect Now CCE-5061-7 CCE-734 Prohibit Access of the Windows Connect Now Wizards GPO Computer Configuration\Administrative Templates\Network\Windows Connect Now CCE-3045-2 CCE-629 todo - description needed todo - description needed Computer Configuration\Administrative Templates\System\Device Installation: Allow remote access to the PnP interface. (Enabled = 1; Disabled = 0) 0 0 1 Computer Configuration\Administrative Templates\System\Device Installation: Do not create system restore point when new device driver installed. (Enabled = 1; Disabled = 0) 0 0 1 Computer Configuration\Administrative Templates\System\Device Installation: Do not send a Windows Error Report when a generic driver is installed on a device. (Enabled = 0; Disabled = 1) 1 0 1 Computer Configuration\Administrative Templates\System\Device Installation: Allow remote access to the PnP interface. GPO Computer Configuration\Administrative Templates\System\Device Installation CCE-3331-6 CCE-593 Computer Configuration\Administrative Templates\System\Device Installation: Do not create system restore point when new device driver installed. GPO Computer Configuration\Administrative Templates\System\Device Installation CCE-3464-5 CCE-849 Computer Configuration\Administrative Templates\System\Device Installation: Do not send a Windows Error Report when a generic driver is installed on a device. GPO Computer Configuration\Administrative Templates\System\Device Installation CCE-3468-6 CCE-571 todo - description needed Computer Configuration\Administrative Templates\System\Driver Installation: Turn Off Windows Update Device Driver Search Prompt. (Enabled = 1; Disabled = 0) 1 0 1 Computer Configuration\Administrative Templates\System\Driver Installation: Turn Off Windows Update Device Driver Search Prompt. GPO Computer Configuration\Administrative Templates\System\Driver Installation CCE-3278-9 CCE-927 The following rules specify the desired setting for the client-side extensions designed for Group Policy. Computer Configuration\Administrative Templates\System: Group Policy - Registry Policy Processing. 0 -1 0 1 2 3 Computer Configuration\Administrative Templates\System: Group Policy - Registry Policy Processing. GPO Computer Configuration\Administrative Templates\System\Group Policy CCE-3452-0 CCE-584 todo - description needed Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Automatic Root Certificates Update. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off downloading of print drivers over HTTP. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Event Views "Events.asp" Links. Disabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Handwriting Reconition Error Reporting. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Internet Connection Wizard if URL Connection is Referring to Microsoft.com. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Internet File Association Service. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off printing over HTTP. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Registration if URL Connection is Referring to Microsoft.com. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off Search Companion content file updates. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off the "Order Prints" Picture Task. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off the "Publish to Web" task for files and folders. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Windows Error Reporting. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Windows Movies Maker Automatic Codec Downloads. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Windows Movie Maker Online Web Links. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Windows Movie Maker Saving to Online Video Hosting Provider. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off Windows Update device driver searching. Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Automatic Root Certificates Update. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-3454-6 CCE-858 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off downloading of print drivers over HTTP. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-2754-0 CCE-887 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Event Views "Events.asp" Links. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-3348-0 CCE-263 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Handwriting Reconition Error Reporting. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-2868-8 CCE-430 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Internet Connection Wizard if URL Connection is Referring to Microsoft.com. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-3432-2 CCE-1055 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off Internet download for Web publishing and online ordering wizards. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-3364-7 CCE-691 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Internet File Association Service. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-2697-1 CCE-1064 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off printing over HTTP. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-3421-5 CCE-852 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Registration if URL Connection is Referring to Microsoft.com. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-3093-2 CCE-88 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off Search Companion content file updates. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-2778-9 CCE-818 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off the "Order Prints" Picture Task. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-3115-3 CCE-375 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off the "Publish to Web" task for files and folders. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-2477-8 CCE-1009 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off the Windows Messenger Customer Experience Improvement Program. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-3259-9 CCE-722 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Windows Error Reporting. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-4694-6 CCE-592 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Windows Movies Maker Automatic Codec Downloads. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-3403-3 CCE-1040 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Windows Movie Maker Online Web Links. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-3297-9 CCE-1062 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn Off Windows Movie Maker Saving to Online Video Hosting Provider. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-3385-2 CCE-93 Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings: Turn off Windows Update device driver searching. GPO Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings CCE-3278-9 CCE-927 todo - description needed Computer Configuration\Administrative Templates\System: Logon - Always Use Classic Logon. Enabled Disabled Enabled Enabled Enabled Computer Configuration\Administrative Templates\System: Logon - Don’t Display the Getting Started Welcome Screen at Logon. Enabled Disabled Enabled Enabled Enabled Computer Configuration\Administrative Templates\System: Logon - Always Use Classic Logon. GPO Computer Configuration\Administrative Templates\System\Logon CCE-4813-2 CCE-231 Computer Configuration\Administrative Templates\System: Logon - Don’t Display the Getting Started Welcome Screen at Logon. GPO Computer Configuration\Administrative Templates\System\Logon CCE-2781-3 CCE-1020 todo - description needed Computer Configuration\Administrative Templates\System\Power Management: Sleep Settings - Require a Password when a Computer Wakes (On Battery). Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Power Management: Sleep Settings - Require a Password when a Computer Wakes (Plugged). Enabled Disabled Enabled Computer Configuration\Administrative Templates\System\Power Management: Sleep Settings - Require a Password when a Computer Wakes (On Battery). GPO Computer Configuration\Administrative Templates\System\Power Management\Sleep Settings CCE-2821-7 CCE-346 Computer Configuration\Administrative Templates\System\Power Management: Sleep Settings - Require a Password when a Computer Wakes (Plugged). GPO Computer Configuration\Administrative Templates\System\Power Management\Sleep Settings CCE-3469-4 CCE-1011 todo - description needed Computer Configuration\Administrative Templates\System: Remote Assistance - Offer Remote Assistance. Disabled Not Configured Disabled Enabled Computer Configuration\Administrative Templates\System: Remote Assistance - Solicited Remote Assistance. Disabled Not Configured Disabled Enabled Computer Configuration\Administrative Templates\System: Remote Assistance - Turn on session logging. Enabled Disabled Enabled Computer_Configuration - Administrative_Templates - System: Remote Assistance - Offer Remote Assistance. GPO Computer Configuration\Administrative Templates\System\Remote Assistance CCE-3217-7 CCE-434 Computer_Configuration - Administrative_Templates - System: Remote Assistance - Solicited Remote Assistance. GPO Computer Configuration\Administrative Templates\System\Remote Assistance CCE-3323-3 CCE-859 Computer_Configuration - Administrative_Templates - System: Remote Assistance - Turn on session logging. GPO Computer Configuration\Administrative Templates\System\Remote Assistance CCE-3271-4 CCE-835 todo - description needed Computer Configuration\Administrative Templates\System: Remote Assistance - Restrictions for Unauthenticated RPC clients. (Enabled: Authenticated = 1) 1 0 1 2 Computer Configuration\Administrative Templates\System: Remote Assistance - RPC Endpoint Mapper Client Authentication. Enabled Disabled Enabled Computer_Configuration - Administrative_Templates - System: Remote Assistance - Restrictions for Unauthenticated RPC clients. GPO Computer Configuration\Administrative Templates\System\Remote Procedure Call CCE-3160-9 CCE-423 Computer_Configuration - Administrative_Templates - System: Remote Assistance - RPC Endpoint Mapper Client Authentication. GPO Computer Configuration\Administrative Templates\System\Remote Procedure Call CCE-3394-4 CCE-145 todo - description needed todo - description needed 1 1 2 4 8 10 16 17 32 255 Disable ISATAP, Teredo, and 6to4 tunneling protocols todo - description needed Computer Configuration\Administrative Templates\Windows Components: Autoplay Policies Computer Configuration\Administrative Templates\Windows Components\Autoplay Policies: Turn off Autoplay. GPO Computer Configuration\Administrative Templates\Windows Components\AutoPlay Policies CCE-2719-3 CCE-44 Computer Configuration\Administrative Templates\Windows Components: Credential User Interface Computer Configuration\Administrative Templates\Windows Components\Credential User Interface: Enumerate administrator accounts on elevation. Not Configured Disabled Enabled Computer Configuration\Administrative Templates\Windows Components\Credential User Interface: Enumerate administrator accounts on elevation. GPO Computer Configuration\Administrative Templates\Windows Components\Credential User Interface CCE-2471-1 CCE-935 Computer Configuration\Administrative Templates\Windows Components: Digial Locker Computer Configuration\Administrative Templates\Windows Components\Digial Locker: Do not allow Digital Locker to run. Enabled Disabled Enabled Computer Configuration\Administrative Templates\Windows Components\Digial Locker: Do not allow Digital Locker to run. GPO Computer Configuration\Administrative Templates\Windows Components\Digital Locker CCE-3482-7 CCE-1747 Windows Vista records information about significant events in four logs: the Application Log, the Security Log, the Setup Log, and the System Log. The logs contain error messages, audit information, and other records of activity on the system. The logs can be used not only to identify suspicious and malicious behavior and investigate security incidents, but also to assist in troubleshooting system and application problems. It is important to specify the maximum log size because if it is too low, the system will not have much room for storing information on system activity. The value defines the maximum size (in KB) of the application log. 32768 16384 32768 81920 The value defines the maximum size (in KB) of the security log. 81920 16384 32768 81920 The value defines the maximum size (in KB) of the setup log. 32768 16384 32768 81920 The value defines the maximum size (in KB) of the system log. 32768 16384 32768 81920 Maximum Application Log Size GPO Computer Configuration\Administrative Templates\Windows Components\Event Log Service\Application CCE-3015-5 CCE-185 Maximum Security Log Size GPO Computer Configuration\Administrative Templates\Windows Components\Event Log Service\Security CCE-3302-7 CCE-757 Maximum Setup Log Size GPO Computer Configuration\Administrative Templates\Windows Components\Event Log Service\Setup CCE-4086-5 CCE-262 Maximum System Log Size GPO Computer Configuration\Administrative Templates\Windows Components\Event Log Service\System CCE-3165-8 CCE-735 Computer Configuration\Administrative Templates\Windows Components: Game Explorer Computer Configuration\Administrative Templates\Windows Components\Game Explorer: Turn Off Downloading of Game Information. Enabled Disabled Enabled Computer Configuration\Administrative Templates\Windows Components\Game Explorer: Turn Off Downloading of Game Information. GPO Computer Configuration\Administrative Templates\Windows Components\Game Explorer CCE-2755-7 CCE-1778 Internet Information Services This blocks even local Administrators from adding local web services to the Vista client 1 0 1 1 1 1 1 This blocks even local Administrators from adding local web services to the XP client GPO Computer Configuration\Administrative Templates\Windows Components\Internet Information Services CCE-3288-8 CCE-474 Computer Configuration\Administrative Templates\Windows Components: NetMeeting Computer Configuration\Administrative Templates\Windows Components\NetMeeting: Disable remote Desktop Sharing. Not Configured Disabled Enabled Computer Configuration\Administrative Templates\Windows Components\NetMeeting: Disable remote Desktop Sharing. GPO Computer Configuration\Administrative Templates\Windows Components\NetMeeting CCE-3082-5 CCE-232 Online Assistance Specifies whether untrusted content is rendered. By default, the Help viewer renders untrusted assistance content pages with the exception of active links. Active links, such as ShellExecute and Guided Help, are rendered as text and are not clickable. 1 0 1 Specifies whether untrusted content is rendered. By default, the Help viewer renders untrusted assistance content pages with the exception of active links. Active links, such as ShellExecute and Guided Help, are rendered as text and are not clickable. GPO Computer Configuration\Administrative Templates\Windows Components\Online Assistance CCE-3046-0 CCE-95 Search Allow indexing of encrypted files Disabled Disabled Enabled Prevent indexing uncached Exchange folders Enabled Disabled Enabled Allow indexing of encrypted files GPO Computer Configuration\Administrative Templates\Windows Components\Search CCE-3376-1 CCE-1049 Prevent indexing uncached Exchange folders GPO Computer Configuration\Administrative Templates\Windows Components\Search CCE-3143-5 CCE-1058 Computer Configuration\Administrative Templates\Windows Components: Terminal Services Do not allow passwords to be saved Enabled Not Configured Disabled Enabled Do not allow drive redirection Enabled Not Configured Disabled Enabled Always prompt client for password upon connection Not Configured Disabled Enabled Set client connection encryption level 3 1 2 3 You can use this policy setting to specify the maximum amount of time that a disconnected session is kept active on the server. By default, Terminal Services allows users to disconnect from a remote session without logging off and ending the session. (1 min) 60000 60000 This policy setting allows you to specify the maximum amount of time that an active Terminal Services session can be idle (without user input) before it is automatically disconnected. (15 min) 900000 900000 The "Do not allow passwords to be saved" setting should be configured correctly for Terminal Services. GPO Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Remote Desktop Connection Client CCE-2975-1 CCE-976 The "Do not allow drive redirection" setting should be configured correctly for Terminal Services. GPO Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Device and Resource Redirection CCE-4501-3 CCE-648 The "Always Prompt Client for Password upon Connection" policy should be set correctly for Terminal Services. GPO Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Security CCE-3429-8 CCE-855 The "Set Client connection Encryption Level" policy should be set correctly for Terminal Services. GPO Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Security CCE-4866-0 CCE-397 The "Set time limit for disconnected sessions" policy should be set correctly for Terminal Services. GPO Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits CCE-5007-0 CCE-920 The "Set time limit for idle sessions" policy should be set correctly for Terminal Services. GPO Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits CCE-4267-1 CCE-123 Windows Defender When Windows Defender detects software or changes by software not yet classified for risks, you see how other members responded to the alert. In turn, the action you apply help other members choose how to respond. Your actions also help Microsoft choose which software to investigate for potential threats. You can choose to send basic or additional information about detected software. Additional information helps improve how Windows Defender works. It can include, for example, the location of detected items on your computer if harmful software has been removed. Windows Defender will automatically collect and send the information. 0 0 1 When Windows Defender detects software or changes by software not yet classified for risks, you see how other members responded to the alert. In turn, the action you apply help other members choose how to respond. Your actions also help Microsoft choose which software to investigate for potential threats. You can choose to send basic or additional information about detected software. Additional information helps improve how Windows Defender works. It can include, for example, the location of detected items on your computer if harmful software has been removed. Windows Defender will automatically collect and send the information. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Defender CCE-4761-3 CCE-312 Windows Error Reporting If this setting is enabled Windows Error Reporting events will not be logged to the system event log. 0 0 1 If this setting is enabled, Windows Error Reporting will not send any problem information to Microsoft. Additionally, solution information will not be available in the Problem Reports and Solutions control panel. 1 0 1 todo - description needed 1 1 0 If this setting is enabled any additional data requests from Microsoft in response to a Windows Error Reporting event will be automatically declined without notice to the user. 1 0 1 If this setting is enabled Windows Error Reporting events will not be logged to the system event log. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Error Reporting CCE-4915-5 CCE-959 If this setting is enabled, Windows Error Reporting will not send any problem information to Microsoft. Additionally, solution information will not be available in the Problem Reports and Solutions control panel. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Error Reporting CCE-5034-4 CCE-803 The "Display Error Notification" setting should be configured correctly. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Error Reporting CCE-4919-7 CCE-259 If this setting is enabled any additional data requests from Microsoft in response to a Windows Error Reporting event will be automatically declined without notice to the user. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Error Reporting CCE-4089-9 CCE-798 Windows Explorer Turn off Heap termination on corruption 0 0 1 Turn off shell protocol protected mode 0 0 1 Turn off Heap termination on corruption GPO Computer Configuration\Administrative Templates\Windows Components\Windows Explorer CCE-2962-9 CCE-384 Turn off shell protocol protected mode GPO Computer Configuration\Administrative Templates\Windows Components\Windows Explorer CCE-3125-2 CCE-480 Windows Installer Disable IE security prompt for Windows Installer scripts 0 0 1 Permits users to change installation options that typically are available only to system administrators. This setting bypasses some of the security features of Windows Installer. 0 0 1 This setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor. 1 0 1 Disable IE security prompt for Windows Installer scripts GPO Computer Configuration\Administrative Templates\Windows Components\Windows Installer CCE-4991-6 CCE-261 Permits users to change installation options that typically are available only to system administrators. This setting bypasses some of the security features of Windows Installer. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Installer CCE-4629-2 CCE-415 This setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Installer CCE-3398-5 CCE-612 Windows Logon Options This policy controls whether the logged on user should be notified if the logon server could not be contacted during logon and he has been logged on using previously stored account information. 1 0 1 This setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Logon Options CCE-3341-5 CCE-392 Windows Mail Windows Mail will not check your newsgroup servers for Communities support. 1 0 1 Denies or allows access to the Windows Mail application. If you enable this setting, access to the Windows Mail application is denied. If you disable or do not configure this setting, access to the Windows Mail application is allowed. 0 1 0 0 0 0 0 Windows Mail will not check your newsgroup servers for Communities support. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Mail CCE-2521-3 CCE-96 Denies or allows access to the Windows Mail application. If you enable this setting, access to the Windows Mail application is denied. If you disable or do not configure this setting, access to the Windows Mail application is allowed. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Mail CCE-2525-4 CCE-331 Windows Media Digital Rights Management Prevents Windows Media Digital Rights Management (DRM) from accessing the Internet (or intranet). When enabled, Windows Media DRM is prevented from accessing the Internet (or intranet) for license acquisition and security upgrades. 1 0 1 Prevents Windows Media Digital Rights Management (DRM) from accessing the Internet (or intranet). When enabled, Windows Media DRM is prevented from accessing the Internet (or intranet) for license acquisition and security upgrades. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Media Digital Rights Management CCE-3486-8 CCE-1089 todo - description needed todo - description needed 1 0 1 todo - description needed 1 0 1 The "Do Not Show First Use Dialog Boxes" setting for Windows Media Player should be configured correctly. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Media Player CCE-4405-7 CCE-1140 The "Disable Media Player for automatic updates" policy should be set correctly. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Media Player CCE-4898-3 CCE-455 Windows Meeting Space Windows Meeting Space is a feature that enables quick, face-to-face collaboration for sharing programs and handouts and for passing notes. If you enable this setting, Windows Meeting Space will be turned off. 1 0 1 Windows Meeting Space is a feature that enables quick, face-to-face collaboration for sharing programs and handouts and for passing notes. If you enable this setting, Windows Meeting Space will be turned off. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Meeting Space CCE-2557-7 CCE-992 Computer Configuration\Administrative Templates\Windows Components: Windows Messenger Do not allow Windows Messenger to be run Not Configured Disabled Enabled todo - description needed 1 0 1 Do not allow Windows Messenger to be run GPO Computer Configuration\Administrative Templates\Windows Components\Windows Messenger CCE-3316-7 CCE-729 The "Do Not Automatically Start Windows Messenger" policy should be set correctly. GPO Computer Configuration\Administrative Templates\Windows Components\Windows Messenger CCE-4797-7 CCE-309 Windows SideBar Sidebar gadgets can be deployed as compressed files, either digitally signed or unsigned. If you enable this setting, Windows Sidebar will not extract any gadgets that have not been digitally signed. If you disable or do not configure this setting, Window 1 0 1 Turn Off User Installed Windows Sidebar Gidgets 1 0 1 Sidebar gadgets can be deployed as compressed files, either digitally signed or unsigned. If you enable this setting, Windows Sidebar will not extract any gadgets that have not been digitally signed. If you disable or do not configure this setting, Window GPO Computer Configuration\Administrative Templates\Windows Components\Windows Sidebar CCE-3456-1 CCE-297 Override the More Gadgets Lnk GPO Computer Configuration\Administrative Templates\Windows Components\Windows Sidebar CCE-3214-4 CCE-702 Turn Off User Installed Windows Sidebar Gidgets GPO Computer Configuration\Administrative Templates\Windows Components\Windows Sidebar CCE-3500-6 CCE-644 todo - description needed todo - description needed Password protect the screen saver Enabled Enabled Specifies how much user idle time must elapse before the screen saver is launched. When configured, this idle time can be set from a minimum of 1 second to a maximum of 86,400 seconds, or 24 hours. If set to zero, the screen saver will not be started. 900 900 Determines whether screen savers used on the computer are password protected. If you enable this setting, all screen savers are password protected. If you disable this setting, password protection cannot be set on any screen saver. GPO User Configuration\Administrative Templates\Control Panel\Display CCE-4290-3 CCE-949 Specifies how much user idle time must elapse before the screen saver is launched. When configured, this idle time can be set from a minimum of 1 second to a maximum of 86,400 seconds, or 24 hours. If set to zero, the screen saver will not be started. GPO User Configuration\Administrative Templates\Control Panel\Display CCE-3050-2 CCE-830 todo - description needed Prompt for password on resume from hibernate / suspend Enabled Enabled This settings allows you to configure client computers to always lock when resuming from a hibernate or suspend. If you enable this setting, the client computer is locked when it is resumed from a suspend or hibernate state. GPO User Configuration\Administrative Templates\System\Power Management CCE-3169-0 CCE-509 todo - description needed Do not preserve zone information in file attachments Disabled Disabled Enabled Hide mechanisms to remove zone information Enabled Disabled Enabled Notify antivirus programs when opening attachments Enabled Disabled Enabled This policy setting allows you to manage whether Windows marks file attachments with information about their zone of origin (i.e. restricted, Internet, intranet, local). GPO User Configuration\Administrative Templates\Windows Components\Attachment Manager CCE-3437-1 CCE-12 This policy setting allows you to manage whether users can manually remove the zone information from saved file attachments by clicking the Unblock button in the file’s property sheet or by using a check box in the security warning dialog. GPO User Configuration\Administrative Templates\Windows Components\Attachment Manager CCE-2979-3 CCE-58 This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. GPO User Configuration\Administrative Templates\Windows Components\Attachment Manager CCE-3300-1 CCE-372 todo - description needed Prevent users from sharing files within their profile Enabled Disabled Enabled By default users are allowed to share files within their profile to other users on their network once an administrator opts in the computer. An administrator can opt in the computer by using the sharing wizard to share a file within their profile. GPO User Configuration\Administrative Templates\Windows Components\Network Sharing CCE-5070-8 CCE-1144 todo - description needed Specifies whether users can provide ratings for Help content. 0 -1 0 1 Specifies whether users can participate in the Help Experience Improvement program. 0 -1 0 1 Specifies whether users can provide ratings for Help content. GPO User Configuration | Administrative Templates | System | Internet Communication Management | Internet Communication settings CCE-4851-2 CCE-1109 Specifies whether users can participate in the Help Experience Improvement program. GPO User Configuration | Administrative Templates | System | Internet Communication Management | Internet Communication settings CCE-5239-9 CCE-174 Windows Vista give more control over individual audit policy through subcategories that were not available in earlier versions of Windows operating systems. The Account Management audit category helps you track attempts to create new users or groups, rename users or groups, enable or disable user accounts, change account passwords, and enable auditing for Account Management events. If you enable this Audit policy setting, administrators can track events to detect malicious, accidental, and authorized creation of user and group accounts. todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed CCE-4938-7 CCE-801 CCE-4700-1 CCE-1016 todo - description needed CCE-4093-1 CCE-1070 CCE-4228-3 CCE-840 todo - description needed CCE-4115-2 CCE-515 CCE-4140-0 CCE-1048 todo - description needed CCE-4916-3 CCE-206 CCE-4783-7 CCE-1202 todo - description needed CCE-5048-4 CCE-1118 CCE-4142-6 CCE-369 todo - description needed CCE-4833-0 CCE-1043 CCE-5097-1 CCE-924 The Detailed Tracking audit category determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access. Enabling Audit process tracking will generate a large number of events, so it is typically set to No Auditing. However, this setting can provide a great benefit during an incident response from the detailed log of the processes started and the time when they were launched. todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed CCE-5000-5 CCE-1413 CCE-4493-3 CCE-699 todo - description needed CCE-4166-5 CCE-913 CCE-5094-8 CCE-1079 todo - description needed CCE-4869-4 CCE-416 CCE-4363-8 CCE-1250 todo - description needed CCE-4891-8 CCE-1219 CCE-4759-7 CCE-1365 The DS Access audit category applies only to domain controllers. todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed CCE-5023-7 CCE-207 CCE-4658-1 CCE-1186 todo - description needed CCE-5028-6 CCE-1199 CCE-4931-2 CCE-459 todo - description needed CCE-5067-4 CCE-317 CCE-4808-2 CCE-982 todo - description needed CCE-5089-8 CCE-881 CCE-4176-4 CCE-247 This audit category generates events that record the creation and destruction of logon sessions. These events occur on the accessed computer. For interactive logons, the generation of these events occurs on the computer that is logged on to. If a network logon takes place to access a share, these events generate on the computer that hosts the accessed resource. todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed CCE-4342-2 CCE-1264 CCE-4857-9 CCE-1282 todo - description needed CCE-5011-2 CCE-1028 CCE-4505-4 CCE-362 todo - description needed CCE-5016-1 CCE-1207 CCE-4650-8 CCE-351 todo - description needed CCE-5038-5 CCE-1257 CCE-4928-8 CCE-1274 todo - description needed CCE-4703-5 CCE-493 CCE-4183-0 CCE-996 todo - description needed CCE-5018-7 CCE-1284 CCE-4423-0 CCE-1097 todo - description needed CCE-5163-1 CCE-378 CCE-5066-6 CCE-1208 todo - description needed CCE-4956-9 CCE-371 CCE-4824-9 CCE-1038 By itself, this policy setting will not cause auditing of any events. It determines whether to audit the event of a user who accesses an object—for example, a file, folder, registry key, or printer—that has a specified system access control list (SACL), effectively enabling auditing to take place. todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed CCE-5084-9 CCE-1322 CCE-4829-8 CCE-379 todo - description needed CCE-4714-2 CCE-1345 CCE-4868-6 CCE-1261 todo - description needed CCE-4200-2 CCE-1372 CCE-5145-8 CCE-1033 todo - description needed CCE-4921-3 CCE-1085 CCE-5039-3 CCE-1340 todo - description needed CCE-4568-2 CCE-717 CCE-5079-9 CCE-744 todo - description needed CCE-4947-8 CCE-385 CCE-4335-6 CCE-589 todo - description needed CCE-4828-0 CCE-1363 CCE-4965-0 CCE-1244 todo - description needed CCE-4996-5 CCE-1288 CCE-4885-0 CCE-1305 todo - description needed CCE-5132-6 CCE-642 CCE-4691-2 CCE-1026 todo - description needed CCE-4594-8 CCE-1138 CCE-5087-2 CCE-1283 todo - description needed CCE-4616-9 CCE-446 CCE-4982-5 CCE-451 The Policy Change audit category determines whether to audit every incident of a change to user rights assignment policies, Windows Firewall policies, Trust policies, or changes to the Audit policy itself. todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed CCE-4201-0 CCE-1110 CCE-5137-5 CCE-991 todo - description needed CCE-4877-7 CCE-388 CCE-4516-1 CCE-180 todo - description needed CCE-5172-2 CCE-187 CCE-5058-3 CCE-448 todo - description needed CCE-5177-1 CCE-1042 CCE-4939-5 CCE-1112 todo - description needed CCE-5181-3 CCE-203 CCE-4204-4 CCE-879 todo - description needed CCE-4479-2 CCE-205 CCE-4995-7 CCE-787 The Privilege Use audit category determines whether to audit each instance of a user exercising a user right. If you configure this value to Success, an audit entry is generated each time that a user right is exercised successfully. If you configure this value to Failure, an audit entry is generated each time that a user right is exercised unsuccessfully. This policy setting can generate a very large number of event records. todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed CCE-5114-4 CCE-391 CCE-4990-8 CCE-404 todo - description needed CCE-5131-8 CCE-1203 CCE-4205-1 CCE-406 todo - description needed CCE-4300-0 CCE-488 CCE-4734-0 CCE-1258 The System audit category allows you to monitor system events that succeed and fail, and provides a record of these events that may help determine instances of unauthorized system access. System events include starting or shutting down computers in your environment, full event logs, or other security-related events that affect the entire system. todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed AUDIT_NONE AUDIT_(SUCCESS|SUCCESS_FAILURE) AUDIT_(FAILURE|SUCCESS_FAILURE) AUDIT_SUCCESS_FAILURE AUDIT_NONE todo - description needed CCE-4976-7 CCE-1177 CCE-4879-3 CCE-1314 todo - description needed CCE-4998-1 CCE-1332 CCE-4883-5 CCE-337 todo - description needed CCE-4535-1 CCE-1121 CCE-5157-3 CCE-1139 todo - description needed CCE-5170-6 CCE-1270 CCE-4910-6 CCE-1102 todo - description needed CCE-5047-6 CCE-856 CCE-4822-3 CCE-336 Securing a given computer has become increasingly important. As such, it is essential to keep a host up to current patch levels to eliminate known vulnerabilities and weaknesses. In conjunction with antivirus software and a personal firewall, patching goes a long way to securing a host against outside attacks and exploitation. Microsoft provides two mechanisms for distributing security updates: Automatic Updates and Microsoft Update. In smaller environments, either method may be sufficient for keeping systems current with patches. Other environments typically have a software change management control process or a patch management program that tests patches before deploying them; distribution may then occur through local Windows Update Services (WUS) or Windows Server Update Services (WSUS) servers, which provide approved security patches for use by the Automatic Updates feature. All known security patches have been installed.