Group Policy Management
body { font-size:68%;font-family:MS Shell Dlg; margin:0px,0px,0px,0px; border: 1px solid #666666; background:#F6F6F6; width:100%; word-break:normal; word-wrap:break-word; } .head { font-weight:bold; font-size:160%; font-family:MS Shell Dlg; width:100%; color:#6587DC; background:#E3EAF9; border:1px solid #5582D2; padding-left:8px; height:24px; } .path { margin-left: 10px; margin-top: 10px; margin-bottom:5px;width:100%; } .info { padding-left:10px;width:100%; } table { font-size:100%; width:100%; border:1px solid #999999; } th { border-bottom:1px solid #999999; text-align:left; padding-left:10px; height:24px; } td { background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; } .btn { width:100%; text-align:right; margin-top:16px; } .hdr { font-weight:bold; border:1px solid #999999; text-align:left; padding-top: 4px; padding-left:10px; height:24px; margin-bottom:-1px; width:100%; } .bdy { width:100%; height:182px; display:block; overflow:scroll; z-index:2; background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; border:1px solid #999999; } button { width:6.9em; height:2.1em; font-size:100%; font-family:MS Shell Dlg; margin-right:15px; } @media print { .bdy { display:block; overflow:visible; } button { display:none; } .head { color:#000000; background:#FFFFFF; border:1px solid #000000; } }
Setting Path:
Explanation
No explanation is available for this setting.
Supported On:
Not available

MSFT Windows Server 1909 - Domain Controller
Data collected on: 11/11/2019 5:02:24 PM |

General
Details

Domain | security.local
Owner | SECURITY\Domain Admins
Created | 2/7/2017 6:10:14 PM
Modified | 11/11/2019 4:28:58 PM
User Revisions | 2 (AD), 2 (SYSVOL)
Computer Revisions | 86 (AD), 86 (SYSVOL)
Unique ID | {E911AD4D-9C89-4BE3-AE6E-269D734C2330}
GPO Status | User settings disabled

Links

Location | Enforced | Link Status | Path
--- | --- | --- | ---
None

This list only includes links in the domain of the GPO.
Security Filtering
The settings in this GPO can only apply to the following groups, users, and computers:

Name
NT AUTHORITY\Authenticated Users

Delegation
These groups and users have the specified permission for this GPO

Name | Allowed Permissions | Inherited
--- | --- | ---
NT AUTHORITY\Authenticated Users | Read (from Security Filtering) | No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS | Read | No
NT AUTHORITY\SYSTEM | Edit settings, delete, modify security | No
SECURITY\Domain Admins | Edit settings, delete, modify security | No
SECURITY\Enterprise Admins | Edit settings, delete, modify security | No

Computer Configuration (Enabled)
Policies
Windows Settings
Security Settings
Local Policies/User Rights Assignment

Policy | Setting
--- | ---
Access Credential Manager as a trusted caller |
Access this computer from the network | BUILTIN\Administrators, NT AUTHORITY\Authenticated Users, NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
Act as part of the operating system |
Allow log on locally | BUILTIN\Administrators
Allow log on through Terminal Services | BUILTIN\Administrators
Back up files and directories | BUILTIN\Administrators
Create a pagefile | BUILTIN\Administrators
Create a token object |
Create global objects | BUILTIN\Administrators, NT AUTHORITY\SERVICE, NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\NETWORK SERVICE
Create permanent shared objects |
Debug programs | BUILTIN\Administrators
Enable computer and user accounts to be trusted for delegation | BUILTIN\Administrators
Force shutdown from a remote system | BUILTIN\Administrators
Impersonate a client after authentication | BUILTIN\Administrators, NT AUTHORITY\SERVICE, NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\NETWORK SERVICE
Load and unload device drivers | BUILTIN\Administrators
Lock pages in memory |
Modify firmware environment values | BUILTIN\Administrators
Perform volume maintenance tasks | BUILTIN\Administrators
Profile single process | BUILTIN\Administrators
Restore files and directories | BUILTIN\Administrators
Take ownership of files or other objects | BUILTIN\Administrators

Local Policies/Security Options
Accounts

Policy | Setting
--- | ---
Accounts: Limit local account use of blank passwords to console logon only | Enabled

Domain Controller

Policy | Setting
--- | ---
Domain controller: LDAP server signing requirements | Require signing

Interactive Logon

Policy | Setting
--- | ---
Interactive logon: Smart card removal behavior | Lock Workstation

Microsoft Network Client

Policy | Setting
--- | ---
Microsoft network client: Digitally sign communications (always) | Enabled
Microsoft network client: Send unencrypted password to third-party SMB servers | Disabled

Network Access

Policy | Setting
--- | ---
Network access: Allow anonymous SID/Name translation | Disabled
Network access: Do not allow anonymous enumeration of SAM accounts | Enabled
Network access: Do not allow anonymous enumeration of SAM accounts and shares | Enabled
Network access: Restrict anonymous access to Named Pipes and Shares | Enabled

Network Security

Policy | Setting
--- | ---
Network security: Do not store LAN Manager hash value on next password change | Enabled
Network security: LAN Manager authentication level | Send NTLMv2 response only. Refuse LM & NTLM
Network security: LDAP client signing requirements | Negotiate signing
Network security: Minimum session security for NTLM SSP based (including secure RPC) clients | Enabled
Require NTLMv2 session security | Enabled
Require 128-bit encryption | Enabled
Network security: Minimum session security for NTLM SSP based (including secure RPC) servers | Enabled
Require NTLMv2 session security | Enabled
Require 128-bit encryption | Enabled

System Objects

Policy | Setting
--- | ---
System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) | Enabled

User Account Control

Policy | Setting
--- | ---
User Account Control: Admin Approval Mode for the Built-in Administrator account | Enabled
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode | Prompt for consent on the secure desktop
User Account Control: Behavior of the elevation prompt for standard users | Automatically deny elevation requests
User Account Control: Detect application installations and prompt for elevation | Enabled
User Account Control: Only elevate UIAccess applications that are installed in secure locations | Enabled
User Account Control: Run all administrators in Admin Approval Mode | Enabled
User Account Control: Virtualize file and registry write failures to per-user locations | Enabled

Other

Policy | Setting
--- | ---
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings | Enabled
Domain member: Digitally encrypt or sign secure channel data (always) | Enabled
Domain member: Digitally encrypt secure channel data (when possible) | Enabled
Domain member: Digitally sign secure channel data (when possible) | Enabled
Domain member: Require strong (Windows 2000 or later) session key | Enabled
Interactive logon: Machine inactivity limit | 900 seconds
Microsoft network server: Digitally sign communications (always) | Enabled
Network security: Allow LocalSystem NULL session fallback | Disabled

System Services
Application Identity (Startup Mode: Automatic)
Permissions
No permissions specified
Auditing
No auditing specified
Windows Firewall with Advanced Security
Global Settings

Policy | Setting
--- | ---
Policy version | 2.26
Disable stateful FTP | Not Configured
Disable stateful PPTP | Not Configured
IPsec exempt | Not Configured
IPsec through NAT | Not Configured
Preshared key encoding | Not Configured
SA idle time | Not Configured
Strong CRL check | Not Configured

Domain Profile Settings

Policy | Setting
--- | ---
Firewall state | On
Inbound connections | Block
Outbound connections | Allow
Apply local firewall rules | Not Configured
Apply local connection security rules | Not Configured
Display notifications | Not Configured
Allow unicast responses | Not Configured
Log dropped packets | Not Configured
Log successful connections | Not Configured
Log file path | Not Configured
Log file maximum size (KB) | Not Configured

Private Profile Settings

Policy | Setting
--- | ---
Firewall state | On
Inbound connections | Block
Outbound connections | Allow
Apply local firewall rules | Not Configured
Apply local connection security rules | Not Configured
Display notifications | Not Configured
Allow unicast responses | Not Configured
Log dropped packets | Not Configured
Log successful connections | Not Configured
Log file path | Not Configured
Log file maximum size (KB) | Not Configured

Public Profile Settings

Policy | Setting
--- | ---
Firewall state | On
Inbound connections | Block
Outbound connections | Allow
Apply local firewall rules | Not Configured
Apply local connection security rules | Not Configured
Display notifications | Not Configured
Allow unicast responses | Not Configured
Log dropped packets | Not Configured
Log successful connections | Not Configured
Log file path | Not Configured
Log file maximum size (KB) | Not Configured

Connection Security Settings
Advanced Audit Configuration
Account Logon

Policy | Setting
--- | ---
Audit Credential Validation | Failure
Audit Kerberos Authentication Service | Success, Failure
Audit Kerberos Service Ticket Operations | Failure

Account Management

Policy | Setting
--- | ---
Audit Computer Account Management | Success
Audit Other Account Management Events | Success
Audit Security Group Management | Success
Audit User Account Management | Success, Failure

Detailed Tracking

Policy | Setting
--- | ---
Audit PNP Activity | Success
Audit Process Creation | Success

DS Access

Policy | Setting
--- | ---
Audit Directory Service Access | Failure
Audit Directory Service Changes | Success

Logon/Logoff

Policy | Setting
--- | ---
Audit Account Lockout | Failure
Audit Group Membership | Success
Audit Logon | Success, Failure
Audit Other Logon/Logoff Events | Success, Failure
Audit Special Logon | Success

Object Access

Policy | Setting
--- | ---
Audit Detailed File Share | Failure
Audit File Share | Success, Failure
Audit Other Object Access Events | Success, Failure
Audit Removable Storage | Success, Failure

Policy Change

Policy | Setting
--- | ---
Audit Audit Policy Change | Success
Audit Authentication Policy Change | Success
Audit MPSSVC Rule-Level Policy Change | Success, Failure
Audit Other Policy Change Events | Failure

Privilege Use

Policy | Setting
--- | ---
Audit Sensitive Privilege Use | Success, Failure

System

Policy | Setting
--- | ---
Audit Other System Events | Success, Failure
Audit Security State Change | Success
Audit Security System Extension | Success
Audit System Integrity | Success, Failure

Application Control Policies
Appx Rules

Policy | Setting
--- | ---
Enforce rules of this type | True

Action | User | Name | Rule Type | Exceptions
--- | --- | --- | --- | ---
Allow | Everyone | (Default Rule) All signed packaged apps | Publisher | No

Dll Rules
No rules of type 'Dll Rules' are defined.
Executable Rules

Policy | Setting
--- | ---
Enforce rules of this type | True

Action | User | Name | Rule Type | Exceptions
--- | --- | --- | --- | ---
Deny | Everyone | Block Google Chrome | Publisher | No
Deny | Everyone | Block Mozilla Firefox | Publisher | No
Deny | Everyone | Block Internet Explorer | Publisher | No
Allow | Everyone | (Default Rule) All files located in the Program Files folder | Path | No
Allow | Everyone | (Default Rule) All files located in the Windows folder | Path | No
Allow | BUILTIN\Administrators | (Default Rule) All files | Path | No

Windows Installer Rules
No rules of type 'Windows Installer Rules' are defined.
Script Rules
No rules of type 'Script Rules' are defined.
Administrative Templates
Policy definitions (ADMX files) retrieved from the local computer.
Control Panel/Personalization

Policy | Setting | Comment
--- | --- | ---
Prevent enabling lock screen camera | Enabled |
Prevent enabling lock screen slide show | Enabled |

MS Security Guide

Policy | Setting | Comment
--- | --- | ---
Configure SMB v1 client driver | Enabled |
Configure MrxSmb10 driver | Disable driver (recommended)
Policy | Setting | Comment
Configure SMB v1 server | Disabled |
Enable Structured Exception Handling Overwrite Protection (SEHOP) | Enabled |
Extended Protection for LDAP Authentication (Domain Controllers only) | Enabled |
Configure LdapEnforceChannelBinding | Enabled, always (recommended)
Policy | Setting | Comment
NetBT NodeType configuration | Enabled |
Configure NetBT NodeType | P-node (recommended)
Policy | Setting | Comment
WDigest Authentication (disabling may require KB2871997) | Disabled |

MSS (Legacy)

Policy | Setting | Comment
--- | --- | ---
MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing) | Enabled |
DisableIPSourceRoutingIPv6 | Highest protection, source routing is completely disabled
Policy | Setting | Comment
MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing) | Enabled |
DisableIPSourceRouting | Highest protection, source routing is completely disabled
Policy | Setting | Comment
MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes | Disabled |
MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers | Enabled |

Network/DNS Client

Policy | Setting | Comment
--- | --- | ---
Turn off multicast name resolution | Enabled |

Network/Lanman Workstation

Policy | Setting | Comment
--- | --- | ---
Enable insecure guest logons | Disabled |

Network/Network Connections/Windows Defender Firewall/Domain Profile

Policy | Setting | Comment
--- | --- | ---
Windows Defender Firewall: Protect all network connections | Enabled |

Network/Network Provider

Policy | Setting | Comment
--- | --- | ---
Hardened UNC Paths | Enabled |
Specify hardened network paths. In the name field, type a fully-qualified UNC path for each network resource. To secure all access to a share with a particular name, regardless of the server name, specify a server name of '*' (asterisk). For example, "\\*\NETLOGON". To secure all access to all shares hosted on a server, the share name portion of the UNC path may be omitted. For example, "\\SERVER". In the value field, specify one or more of the following options, separated by commas: 'RequireMutualAuthentication=1': Mutual authentication between the client and server is required to ensure the client connects to the correct server. 'RequireIntegrity=1': Communication between the client and server must employ an integrity mechanism to prevent data tampering. 'RequirePrivacy=1': Communication between the client and the server must be encrypted to prevent third parties from observing sensitive data.
Hardened UNC Paths: |
--- | ---
\\*\NETLOGON | RequireMutualAuthentication=1,RequireIntegrity=1
\\*\SYSVOL | RequireMutualAuthentication=1,RequireIntegrity=1
You should require both Integrity and Mutual Authentication for any UNC paths that host executable programs, script files, or files that control security policies. Consider hosting files that do not require Integrity or Privacy on separate shares from those that absolutely need such security for optimal performance. For additional details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

System/Credentials Delegation

Policy | Setting | Comment
--- | --- | ---
Encryption Oracle Remediation | Enabled |
Protection Level: | Force Updated Clients
Policy | Setting | Comment
Remote host allows delegation of non-exportable credentials | Enabled |

System/Early Launch Antimalware

Policy | Setting | Comment
--- | --- | ---
Boot-Start Driver Initialization Policy | Enabled |
Choose the boot-start drivers that can be initialized: | Good, unknown and bad but critical

System/Group Policy

Policy | Setting | Comment
--- | --- | ---
Configure registry policy processing | Enabled |
Do not apply during periodic background processing | Disabled
Process even if the Group Policy objects have not changed | Enabled

System/Kernel DMA Protection

Policy | Setting | Comment
--- | --- | ---
Enumeration policy for external devices incompatible with Kernel DMA Protection | Enabled |
Enumeration policy | Block all

Windows Components/AutoPlay Policies

Policy | Setting | Comment
--- | --- | ---
Disallow Autoplay for non-volume devices | Enabled |
Set the default behavior for AutoRun | Enabled |
Default AutoRun Behavior | Do not execute any autorun commands
Policy | Setting | Comment
Turn off Autoplay | Enabled |
Turn off Autoplay on: | All drives

Windows Components/Biometrics/Facial Features

Policy | Setting | Comment
--- | --- | ---
Configure enhanced anti-spoofing | Enabled |

Windows Components/Event Log Service/Application

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 32768

Windows Components/Event Log Service/Security

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 196608

Windows Components/Event Log Service/System

Policy | Setting | Comment
--- | --- | ---
Specify the maximum log file size (KB) | Enabled |
Maximum Log Size (KB) | 32768

Windows Components/Remote Desktop Services/Remote Desktop Connection Client

Policy | Setting | Comment
--- | --- | ---
Do not allow passwords to be saved | Enabled |

Windows Components/Remote Desktop Services/Remote Desktop Session Host/Device and Resource Redirection

Policy | Setting | Comment
--- | --- | ---
Do not allow drive redirection | Enabled |

Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security

Policy | Setting | Comment
--- | --- | ---
Always prompt for password upon connection | Enabled |
Require secure RPC communication | Enabled |
Set client connection encryption level | Enabled |
Encryption Level | High Level
Choose the encryption level from the drop-down list.

Windows Components/RSS Feeds

Policy | Setting | Comment
--- | --- | ---
Prevent downloading of enclosures | Enabled |

Windows Components/Search

Policy | Setting | Comment
--- | --- | ---
Allow indexing of encrypted files | Disabled |

Windows Components/Windows Defender SmartScreen/Explorer

Policy | Setting | Comment
--- | --- | ---
Configure Windows Defender SmartScreen | Enabled |
Pick one of the following settings: | Warn and prevent bypass

Windows Components/Windows Ink Workspace

Policy | Setting | Comment
--- | --- | ---
Allow Windows Ink Workspace | Enabled |
Choose one of the following actions |

Windows Components/Windows Installer

Policy | Setting | Comment
--- | --- | ---
Allow user control over installs | Disabled |
Always install with elevated privileges | Disabled |

Windows Components/Windows Logon Options

Policy | Setting | Comment
--- | --- | ---
Sign-in and lock last interactive user automatically after a restart | Disabled |

Windows Components/Windows PowerShell

Policy | Setting | Comment
--- | --- | ---
Turn on PowerShell Script Block Logging | Enabled |
Log script block invocation start / stop events: | Disabled

Windows Components/Windows Remote Management (WinRM)/WinRM Client

Policy | Setting | Comment
--- | --- | ---
Allow Basic authentication | Disabled |
Allow unencrypted traffic | Disabled |
Disallow Digest authentication | Enabled |

Windows Components/Windows Remote Management (WinRM)/WinRM Service

Policy | Setting | Comment
--- | --- | ---
Allow Basic authentication | Disabled |
Allow unencrypted traffic | Disabled |
Disallow WinRM from storing RunAs credentials | Enabled |

User Configuration (Disabled)
No settings defined.