National Institute of Standards and Technology 5.4 2009-04-08T15:04:20.000-05:00 Microsoft Windows XP This definition verifies that locked accounts remains locked for the defined number of minutes before they are automatically unlocked. Microsoft Windows XP Account lockout threshold is the profile defined number of invalid logon attempts Microsoft Windows XP Reset account lockout counters after the profile defined number of minutes Microsoft Windows XP todo Microsoft Windows XP todo Microsoft Windows XP todo Microsoft Windows XP todo Microsoft Windows XP todo Microsoft Windows XP Password history enforcement is enabled and the profile defined number of passwords are remembered Microsoft Windows XP Maximum password age is the profile defined number of days Microsoft Windows XP Minimum password age is the profile defined number of days Microsoft Windows XP Minimum password length is the profile defined number of characters Microsoft Windows XP Passwords must meet complexity requirements Microsoft Windows XP Passwords must be stored using reversible encryption for all users in the domain Microsoft Windows XP This definition tests the the maximum allowed size of the application log is at least as big as the supplied value. Microsoft Windows XP This definition tests the the maximum allowed size of the security log is at least as big as the supplied value. Microsoft Windows XP This definition tests the the maximum allowed size of the system log is at least as big as the supplied value. Microsoft Windows XP This definition tests to see if local guests group is allowed to or prevented from accessing application log based on the supplied value. Microsoft Windows XP This definition tests to see if local guests group is allowed to or prevented from accessing security log based on the supplied value. Microsoft Windows XP This definition tests to see if local guests group is allowed to or prevented from accessing system log based on the supplied value. Microsoft Windows XP This definition tests the retention method for the application log. Possible methods are - overwrite as necessary, do not overwrite, or overwrite events older than X seconds. Microsoft Windows XP Retention method for security log Microsoft Windows XP Retention method for system log Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/rcp.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/reg.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/regedit.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/regedt32.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/arp.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/at.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/attrib.exe file and Users have read and execute permissions Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/cacls.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/debug.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/edlin.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/eventcreate.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/eventtriggers.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access and the Users group has read access to the SYSTEMROOT/system32/mshta.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/net.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/net1.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/netsh.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/regini.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/regsvr32.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/rexec.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/route.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/rsh.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/sc.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/secedit.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/subst.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/systeminfo.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/tftp.exe file and all other users should have no file access privileges Microsoft Windows XP The Administrators group and the System user should have full access to the SYSTEMROOT/system32/tlntsvr.exe file and all other users should have no file access privileges Microsoft Windows XP Audit account logon events Microsoft Windows XP Audit account management Microsoft Windows XP Audit Directory Service Access Microsoft Windows XP Audit logon events Microsoft Windows XP Audit object access Microsoft Windows XP Audit policy changes Microsoft Windows XP Audit privilege use Microsoft Windows XP Audit process tracking Microsoft Windows XP Audit system events Microsoft Windows XP This definition verifies that the Administrator account is enabled/disabled based on the policy defined by the user. Microsoft Windows XP This definition verifies that the Guest account is enabled/disabled based on the policy defined by the user. Microsoft Windows XP Microsoft Windows XP Accounts: Rename Administrator Account Microsoft Windows XP Accounts: Rename Guest Account Microsoft Windows XP Audit the access of global system objects is disabled Microsoft Windows XP Audit the use of Backup and Restore privileges Microsoft Windows XP Audit: Shut down system immediately if unable to log security audits Microsoft Windows XP This check verifies that Windows Server 2003/XP, is configured to restrict DCOM access permissions. Microsoft Windows XP This check verifies that Windows Server 2003/XP, is configured to restrict DCOM launch permissions. Microsoft Windows XP Allow undock without having to log on disabled Microsoft Windows XP Devices: Allowed to format and eject removable media Microsoft Windows XP Prevent users from installing printer drivers Microsoft Windows XP Restrict CD-ROM access to locally logged-on user only Microsoft Windows XP Restrict floppy access to locally logged-on users only Microsoft Windows XP Warn for unsigned driver installation Microsoft Windows XP This setting determines if Server Operators are allowed to submit jobs using the AT schedule utility. Microsoft Windows XP Requires signing be negotiated before Lightweight Directory Access Protocol (LDAP) clients can bind with Active Directory LDAP server. Microsoft Windows XP Determines whether a domain controller will accept password requests for computer accounts. Microsoft Windows XP Digitally encrypt or sign secure channel data (always) Microsoft Windows XP Digitally encrypt secure channel data (when possible) Microsoft Windows XP Digitally sign secure channel data (when possible) Microsoft Windows XP Disable machine account password changes Microsoft Windows XP Maximum machine account password age is profile defined number of days Microsoft Windows XP Require strong (Windows 2000 or later) session key Microsoft Windows XP Do not display last user name logged on Microsoft Windows XP Do not require CTRL+ALT+DEL for logon Microsoft Windows XP Set message text for users attempting to log on Microsoft Windows XP Set message title for users attempting to log on Microsoft Windows XP Number of previous logons to cache (in case domain controller is not available) is profile defined Microsoft Windows XP Prompt user to change password before expiration Microsoft Windows XP Require Domain Controller authentication to unlock workstation Microsoft Windows XP Forces use of a SmartCard to log in at the workstation interactively. Microsoft Windows XP Smart card removal behavior for interactive logon Microsoft Windows XP Microsoft network client: Digitally sign communications (always) Microsoft Windows XP Microsoft network client: Digitally sign communications Microsoft Windows XP Microsoft network client: Send unencrypted password to third-party SMB servers disabled Microsoft Windows XP Microsoft network server: Amount of idle time required before suspending session Microsoft Windows XP Microsoft network server: Digitally sign communications (always) Microsoft Windows XP Microsoft network server: Digitally sign communications (if client agrees) Microsoft Windows XP Microsoft network server: Disconnect clients when logon hours expire Microsoft Windows XP MSS: (AutoAdminLogon) Enable Automatic Logon disabled Microsoft Windows XP MSS: (DisableIPSourceRouting) IP source routing protection level Microsoft Windows XP MSS: (EnableDeadGWDetect) Allow automatic detection of dead network gateways Microsoft Windows XP MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes disabled Microsoft Windows XP When this parameter is set to 1, TCP attempts to discover the Maximum Transmission Unit (MTU), the size of the largest packet that can be kept intact over the path to a remote host. Setting this parameter to 0 disables the feature and causes an MTU of 576 bytes to be used for all connections that are not made to hosts on the local subnet. Microsoft Windows XP MSS: (Hidden) Hide Computer From the Browse List Microsoft Windows XP MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds Microsoft Windows XP MSS: (NoDefaultExempt) Enable NoDefaultExempt for IPSec Filtering Microsoft Windows XP MSS: (NoDriveTypeAutoRun) Disable Autorun for all drives Microsoft Windows XP MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers Microsoft Windows XP MSS: (NtfsDisable8dot3NameCreation) Enable the computer to stop generating 8.3 style filenames Microsoft Windows XP MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure DefaultGateway addresses Microsoft Windows XP MSS: (SafeDllSearchMode) Enable Safe DLL search mode Microsoft Windows XP MSS (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires Microsoft Windows XP MSS: (SynAttackProtect) Syn attack protection level Microsoft Windows XP MSS: (TCPMaxConnectResponseRetransmissions) SYN-ACK retransmissions when a connection request is not acknowledged Microsoft Windows XP (TCPMaxDataRetransmissions) How many times unacknowledged data is retransmitted Microsoft Windows XP MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning Microsoft Windows XP Determines if an anonymous user can request security identifier (SID) attributes for another user. Microsoft Windows XP Network access: Do not allow anonymous enumeration of SAM accounts Microsoft Windows XP Network access: Do not allow anonymous enumeration of SAM accounts and shares Microsoft Windows XP Network access: Do not allow storage of credentials or .NET Passports for network authentication Microsoft Windows XP Network access: Let Everyone permissions apply to anonymous users Microsoft Windows XP Network access: Named Pipes that can be accessed anonyumously Microsoft Windows XP Network access: Remotely accessible registry paths Microsoft Windows XP Network access: Shares that can be accessed anonmously Microsoft Windows XP Network access: Sharing and security model for local accounts Microsoft Windows XP Network security: Do not store LAN Manager hash value on next password change Microsoft Windows XP Network security: Force logoff when logon hours expire Microsoft Windows XP Network security: LAN Manager authentication level Microsoft Windows XP Network security: LDAP client signing requirements Microsoft Windows XP Network security: Minimum session security for NTLM SSP based (including secure RPC) clients Microsoft Windows XP Network security: Minimum session security for NTLM SSP based (including secure RPC) servers Microsoft Windows XP Recovery console: Allow automatic administrative logon Microsoft Windows XP Recovery console: Allow floppy copy and access to all drives and all folders disabled Microsoft Windows XP Shutdown: Allow system to be shut down without having to log on disabled Microsoft Windows XP Shutdown: Clear virtual memory pagefile Microsoft Windows XP System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Microsoft Windows XP System objects: Default owner for objects created by members of the Administrators group Microsoft Windows XP System objects: Require case insensitivity for non-Windows subsystems Microsoft Windows XP System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) Microsoft Windows XP Administrators may access this computer from the network. NOTE: This can break IPSec see Microsoft Knowledge Base article 823659 for further guidance Microsoft Windows XP No one has the right to act as part of the operating system Microsoft Windows XP Administrators, LOCAL SERVICE, NETWORK SERVICE may adjust memory quotas for a process Microsoft Windows XP No one but Administrators and Remote Desktop Users may logon through Terminal Services Microsoft Windows XP Administrators are allowed to back up files and directories Microsoft Windows XP Administrators and Users may bypass traverse checking Microsoft Windows XP Administrators may change the system time Microsoft Windows XP Administrators may create a pagefile Microsoft Windows XP No one is allowed to create a token object Microsoft Windows XP Administrators, SERVICE, Local Service and Network Service may Create Global Objects Microsoft Windows XP No one is allowed to create permanent shared objects Microsoft Windows XP Administrators are allowed to debug programs Microsoft Windows XP Guests and SUPPORT_388945a0 are denied access to this computer from the network. Note: If the SUPPORT_388945a0 accounts has been renamed perform this check manually. Microsoft Windows XP Guests and SUPPORT_388945a0 are denied logon as a batch job. Note: If the SUPPORT_388945a0 accounts has been renamed perform this check manually. Microsoft Windows XP No one is denied logon as a service Microsoft Windows XP Guests, SUPPORT_388945a0, and any service accounts are denied logon locally. Note: If the SUPPORT_388945a0 accounts has been renamed perform this check manually. Microsoft Windows XP Guests are denied logon through Terminal Services Microsoft Windows XP Administrators may force shutdown from a remote system Microsoft Windows XP LOCAL SERVICE and NETWORK SERVICE may generate security audits Microsoft Windows XP Administrators and SERVICE may Impersonate a Client after Authentication Microsoft Windows XP Administrators may increase scheduling priority Microsoft Windows XP Administrators may load and unload device drivers Microsoft Windows XP No one may lock pages in memory Microsoft Windows XP No one may log on as a batch job Microsoft Windows XP LOGON SERVICE and NETWORK SERVICE may log on as a service Microsoft Windows XP Administrators and Users are allowed to log on locally Microsoft Windows XP Administrators may manage the auditing and security log Microsoft Windows XP Administrators may modify firmware environment variables Microsoft Windows XP Administrators may perform volume maintenance tasks Microsoft Windows XP Administrators may profile a single process Microsoft Windows XP Administrators may profile the system performance Microsoft Windows XP Users and Administrators may remove the computer from its docking station Microsoft Windows XP LOCAL SERVICE and NETWORK SERVICE may replace a process level token Microsoft Windows XP Administrators may restore files and directories Microsoft Windows XP Administrators and Users may shut down the system Microsoft Windows XP No one may synchronize directory service data Microsoft Windows XP Administrators may take ownership of files or other objects Microsoft Windows XP Alerter Service should be disabled Microsoft Windows XP Background Intelligent Transfer Service (a.k.a. BITS) Microsoft Windows XP ClipBook Service should be disabled Microsoft Windows XP Computer Browser Service should be disabled Microsoft Windows XP Error Reporting Service should be disabled Microsoft Windows XP Microsoft Windows XP Fax Service should be disabled Microsoft Windows XP FTP Publishing Service should be disabled Microsoft Windows XP Indexing Service should be disabled Microsoft Windows XP Messenger Service should be disabled Microsoft Windows XP NetMeeting Remote Desktop Sharing Service should be disabled Microsoft Windows XP Network Dynamic Data Exchange (DDE) Service should be disabled Microsoft Windows XP Network DDE DDE Share Database Manager (DSDM) Service should be disabled Microsoft Windows XP Remote Access Connection Manager Service should be disabled Microsoft Windows XP Routing and Remote Access Service should be disabled Microsoft Windows XP Simple Service Discovery Protocol (SSDP) Discovery Service should be disabled Microsoft Windows XP Task Scheduler Service should be disabled Microsoft Windows XP Telnet Service should be disabled Microsoft Windows XP Telnet Services Service should be disabled Microsoft Windows XP Universal Plug and Play Device Host Service should be disabled Microsoft Windows XP Microsoft Windows XP Disabling the setting will prevent all wireless wi-fi interfrace from working unless a third partry management software is used to manage the device. This will not be an issue on managed desktops but will impact mobile device. Microsoft Windows XP WMI Performance Adapter should be configured to start "Manual" Microsoft Windows XP World Wide Web Publishing Service should be disabled Microsoft Windows XP Turn Off Microsoft Peer-to-Peer Networking Services Microsoft Windows XP Prohibit installation and configuration of Network Bridge on your DNS domain network Microsoft Windows XP Prohibit use of Internet Connection Firewall on your DNS domain network Microsoft Windows XP Prohibit use of Internet Connection Sharing on your DNS domain network Microsoft Windows XP Display Error Notification Microsoft Windows XP Internet Explorer Maintenance Policy Processing Would prefer to use the registry for this instead of WMI, but the FDCC XP image does not have the CID of {A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B} that corresponds to the Internet Explorer Maintenance Policy. The image does have the CID {35378EAC-683F-11D2-A89A-00C04FBBCFA2} that corresponds to the registry policy. Reference: http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/93805.mspx?mfr=true Microsoft Windows XP Registry Policy Processing Microsoft Windows XP Turn Off Automatic Root Certificates Update Microsoft Windows XP Turn off downloading of print drivers over HTTP Microsoft Windows XP Turn Off Event Views "Events.asp" Links Microsoft Windows XP Turn Off Internet Connection Wizard if URL Connection is Referring to Microsoft.com Microsoft Windows XP Turn off Internet download for Web publishing and online ordering wizards Microsoft Windows XP Turn Off Internet File Association Service Microsoft Windows XP Turn off printing over HTTP Microsoft Windows XP Turn Off Registration if URL Connection is Referring to Microsoft.com Microsoft Windows XP Turn off Search Companion content file updates Microsoft Windows XP Turn Off the "Order Prints" Picture Task Microsoft Windows XP Turn off the "Publish to Web" task for files and folders Microsoft Windows XP Turn off the Windows Messenger Customer Experience Improvement Program Microsoft Windows XP Turn off Windows Error Reporting Microsoft Windows XP Turn Off Windows Movies Maker Automatic Codec Downloads Microsoft Windows XP Turn Off Windows Movie Maker Online Web Links Microsoft Windows XP Turn Off Windows Movie Maker Saving to Online Video Hosting Provider Microsoft Windows XP Turn off Windows Update device driver searching Microsoft Windows XP Always Use Classic Logon Microsoft Windows XP Do not process the run once list Microsoft Windows XP Don’t Display the Getting Started Welcome Screen at Logon Microsoft Windows XP Offer Remote Assistance Microsoft Windows XP Solicited Remote Assistance Microsoft Windows XP Restrictions for Unauthenticated RPC clients Microsoft Windows XP RPC Endpoint Mapper Client Authentication Microsoft Windows XP This blocks even local Administrators from adding local web services to the Vista client Microsoft Windows XP Disable remote Desktop Sharing Microsoft Windows XP Do not allow passwords to be saved Microsoft Windows XP Set client connection encryption level Microsoft Windows XP You can use this policy setting to specify the maximum amount of time that a disconnected session is kept active on the server. By default, Terminal Services allows users to disconnect from a remote session without logging off and ending the session. (1 min) Microsoft Windows XP This policy setting allows you to specify the maximum amount of time that an active Terminal Services session can be idle (without user input) before it is automatically disconnected. (15 min) Microsoft Windows XP Turn off shell protocol protected mode Microsoft Windows XP Disable IE security prompt for Windows Installer scripts Microsoft Windows XP Permits users to change installation options that typically are available only to system administrators. This setting bypasses some of the security features of Windows Installer. Microsoft Windows XP This setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor. Microsoft Windows XP Do Not Show First Use Dialog Boxes This policy prevents the Privacy Options and Installation Options dialog boxes from being displayed the first time a user starts Windows Media Player. This policy prevents the dialog boxes which allow users to select privacy, file types, and other desktop options from being displayed when the Player is first started. Some of the options can be configured by using other Windows Media Player group policies. When this policy is not configured or disabled, the dialog boxes are displayed when the user starts the Player for the first time. Microsoft Windows XP Prevents users from being prompted to update Windows Media Player. This policy prevents the Player from being updated and prevents users with administrator rights from being prompted to update the Player if an updated version is available. The Check for Player Updates command on the Help menu in the Player is not available. In addition, none of the time intervals in the Check for updates section on the Player tab are selected or available. When this policy is not configured or disabled, Check for Player Updates is available only to users with administrator rights and they may be prompted to update the Player if an updated version is available. By default, users with administrator rights can select how frequently updates are checked for. Users without administrator rights do not see Check for Player Updates and are never prompted to update the Player even without this policy. Microsoft Windows XP This policy prevents a shortcut icon for the Player from being added to the user's desktop. When this policy is not configured or disabled, users can choose whether to add the Player shortcut icon to their desktops. Microsoft Windows XP Do not allow Windows Messenger to be run Microsoft Windows XP todo Microsoft Windows XP Password protect the screen saver Microsoft Windows XP Screen Saver timeout Microsoft Windows XP Prompt for password on resume from hibernate / suspend Microsoft Windows XP Do not preserve zone information in file attachments Microsoft Windows XP Hide mechanisms to remove zone information Microsoft Windows XP Notify antivirus programs when opening attachments Microsoft Windows XP Microsoft Windows XP is installed